Nitori Holdings: a credential stuffing attack hit the "Nitori App", and member data in about 132,000 accounts may have been viewed

1. 2022-09-15

   From this day, unauthorized logins began on the authentication program of the app. [1]

2. 2022-09-19

   It found that member data may have leaked. [1]

3. 2022-09-20

   It announced the case. It was resetting the passwords of the accounts that may have been logged in without authorization. [1]

About 132,000 accounts of Nitori Net, the Nitori App, Shimahoo Net and the Shimahoo app were affected. The information that may have been viewed is the email address, password, member number, points, name, phone number, address, birth date, gender, building type, and a partly masked card number with its expiry date. It does not hold the information needed for card payments. [1]