Case file — Lead incident: Nitori Holdings, Japan's largest furniture and home-goods retailer, says an attacker who slipped into one of its systems in mid-October may have taken up to 37.62 million customer records. The company detected the unauthorized access on November 6 and blocked it, but its investigation found the intruder likely had access for around three weeks before detection. The records at risk include names, email and postal addresses, phone numbers, dates of birth, and gender for individual members and shoppers, plus company and contact details for corporate members. Nitori says account passwords and credit card information were not exposed. The company has not said how the attacker got in or who is behind it, and the 37.62 million figure is an upper bound — the number of records that may have leaked — not a confirmed count of stolen records or victims. Status: access blocked, investigation ongoing with outside specialists; Japan's Personal Information Protection Commission and police notified.
Incident timeline
| Date | Development |
|---|---|
| Mid-to-late October 2026 | Nitori's intrusion window opens; the attacker likely gains access to a company system. |
| October 20, 2026 | Railway attack begins at 07:28 UTC, when an attacker escapes filesystem isolation in the company's build infrastructure. |
| October 21, 2026 | Railway evicts the attacker at 09:24 UTC after a roughly 26-hour intrusion; the company warns customers to rotate secrets the next day. |
| November 2, 2026 | Barracuda patches two ESG flaws (CVE-2026-116606 and CVE-2026-111560) in firmware 9.4.0.030. |
| November 3, 2026 | watchTowr publishes proof-of-concept exploit code for the Barracuda ESG chain. |
| November 5, 2026 | watchTowr publishes its full technical analysis of the Barracuda ESG chain; Barracuda clarifies no authentication is needed to exploit it. |
| November 6, 2026 | Nitori confirms unauthorized access to its systems and blocks the attacker. |
| November 9, 2026 | Barracuda confirms exploitation activity affecting "a small number of organizations"; Nitori discloses that up to 37.62 million records may have leaked. |
| November 10, 2026 | Microsoft's Patch Tuesday fixes 1,093 CVEs including an exploited Outlook zero-day (CVE-2026-124194); Vates confirms the Xen Orchestra auth bypass (VSA-2026-062) is being actively exploited; Railway publishes its full incident report; BleepingComputer reports the Nitori breach. |
1. Nitori says hackers may have taken up to 37.62 million customer records
Nitori Holdings, often called the "IKEA of Japan," disclosed on November 9 that an attacker may have stolen up to 37.62 million customer records after gaining unauthorized access to one of its systems. The company detected the intrusion on November 6 and blocked the access promptly, but log analysis showed the attacker likely had access since mid-October — roughly three weeks of quiet presence before detection. Nitori operates 879 stores in Japan and another 219 across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong.
The records in scope cover individual members, people who bought without an account, corporate members, and orders placed through Nitori's shops on online malls — essentially anyone who has bought from the chain. For individual customers, the data at risk includes membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth, and gender. For corporate members, it includes company names, department names, representatives' names, and contact details. Nitori says account passwords and credit card information were not exposed.
The company says it has fixed the vulnerability in its systems, strengthened threat monitoring, and informed Japan's Personal Information Protection Commission, the police, and other relevant authorities. It has promised to notify affected customers directly by email or post, and warned them that the compromised information could be used in phishing and scam attempts. Nitori has not disclosed how the attacker got in, who is behind the intrusion, or whether it is a ransomware or extortion case — as of November 9, the company had not appeared on ransomware leak sites tracked by researchers.
Investigation notes
Scale, stated carefully: 37.62 million is the number of records Nitori says may have leaked — the outer bound of the incident's scope, not a confirmed count of records stolen or of individual victims. The company says the figure may change as log analysis and data matching continue. Treat it as an upper estimate, not a victim count.
What is confirmed: unauthorized access to a Nitori-managed system, detected November 6; access likely dating to mid-to-late October; notification to the regulator and police; no passwords or card data in the exposed data types.
What is not known: the initial access vector, the threat actor, and whether any data was actually exfiltrated or will be published. No ransomware group has claimed the incident.
Customer risk: the exposed data types — names, addresses, phone numbers, dates of birth — are exactly the raw material for identity theft and targeted phishing. Nitori's own warning to customers is the right one: expect impersonation attempts in the coming weeks.
2. Railway breach: stolen AI keys ran up $740,000 in fraudulent charges
Cloud hosting provider Railway published its full incident report on November 10, confirming that attackers who broke into its systems in October stole customer authentication secrets and generated approximately $740,000 in fraudulent AI usage. The attack began on October 20, when hackers exploited a previously unknown vulnerability in Railway's multi-tenant build infrastructure to partly escape filesystem isolation and obtain an internal build credential. They then read the stored histories of 353 builds, including sealed environment variables and a copy of internal source code, and later used a misconfigured trust relationship to decrypt per-environment keys between 04:42 and 07:14 UTC on October 21.
Railway says the decrypted variables affected at most 1.85% of its workspaces — about 100,000 workspaces as an upper bound, not a confirmed count of credentials actually stolen. Linked-account tokens belonging to 1,852 users were also exposed, including GitHub OAuth tokens and AI agent keys; all have been reset. The attackers specifically searched for AI provider credentials, and Railway believes the goal was resale or use in AI model distillation — part of a wider wave of attacks against AI developer platforms that security firm Wiz has dubbed "Black October." The company says customer databases were not accessed and no Railway account logins were used with stolen credentials.
Railway says it is working with affected AI providers to secure reimbursements and will cover charges that providers decline to refund. AWS Bedrock and Google Gemini are refunding fraudulent use under their fraud policies; OpenAI and SpaceXSI are reviewing cases individually; Railway is covering Anthropic charges while talks continue, and OpenRouter is enforcing a no-refund policy. The company has filed a complaint with the FBI's Internet Crime Complaint Center (IC3) and engaged a forensics firm. The attackers were fully removed from Railway's systems on October 21, and all exploited vulnerabilities have since been remediated.
Investigation notes
The attack chain: build-system isolation escape (October 20, 07:28 UTC) → internal credential accepted by Railway's Temporal instance → build-history reads → misconfigured trust relationship used to decrypt environment keys (October 21, 04:42–07:14 UTC) → eviction at 09:24 UTC. Railway described the roughly 26-hour intrusion as a contest of agent speed, with attackers using AI-powered agents to find and exploit flaws.
What customers should do: Railway told every customer — not only those later confirmed as affected — to rotate all secrets and check the services they unlock for misuse. Anyone who stored AI provider keys in Railway before the rotation should treat them as compromised.
The wider pattern: Railway links the intrusion to attacks on other AI platforms in the same window — OpenCode, Warp, and Fireworks AI reported similar thefts between October 6 and 23. The prize in each case is the same: provider keys that can be resold or fed into model-distillation pipelines.
3. Barracuda confirms its ESG flaws are now being exploited in the wild
Barracuda confirmed on November 9 that attackers are exploiting a recently patched vulnerability chain in its Email Security Gateway (ESG) against "a small number of organizations." The chain joins two flaws: CVE-2026-116606, a pre-authentication authorization bypass rated 9.3 (Critical) on CVSS 4.0, and CVE-2026-111560, a command-injection flaw rated 8.6. Together, they let an unauthenticated attacker with network access to the ESG administrative interface upload a forged configuration backup and execute arbitrary commands as root — full takeover of the gateway, with no login required.
Barracuda released patches on November 2 in ESG firmware 9.4.0.030 (with patch BNSF-40425 for firmware 9.4.017 and later, and BNSF-40430 for older firmware). On November 5, watchTowr Labs published its full technical analysis of the chain and released proof-of-concept exploit code; Barracuda updated its advisory the same day to clarify that no authentication is needed. The Canadian Centre for Cyber Security has also issued advisory AV26-1112 on the flaws. As of the November 9 update, neither CVE had been added to CISA's Known Exploited Vulnerabilities catalog.
The command-injection flaw also affects five other Barracuda products — Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway — but on those it still requires an administrator account. Only the ESG carries the full pre-auth chain. The disclosure follows the 2023 UNC4841 zero-day campaign against Barracuda ESG (CVE-2023-2868), which made the gateway a proven target for state-linked attackers.
Investigation notes
Official anchor: Barracuda's own advisory update of November 9 confirms exploitation activity. The vendor does not say who is behind the attacks or how many devices are affected beyond "a small number of organizations." No victim countries have been named, so no country is tagged for this story.
Patch status: upgrade ESG to firmware 9.4.0.030 or later. Sources disagree on whether 9.4.0.029 or 9.4.0.030 is the build that fully closes the bypass — Barracuda's advisory lists 9.4.0.030; go by the advisory and confirm the installed build in the admin interface.
Compromise check: a patched gateway still needs a compromise check. Watch for unexplained configuration backup restores and review admin-interface access logs for the window between the November 2 patch release and the patch being applied.
4. Microsoft patches 1,093 flaws, including an exploited Outlook zero-day
Microsoft's November 2026 Patch Tuesday, released November 10, fixes 1,093 Microsoft-assigned vulnerabilities, 63 of them rated critical. The one flaw Microsoft says attackers are already exploiting is CVE-2026-124194, an Outlook spoofing vulnerability rated Moderate with a CVSS score of 6.5. If a user opens a specially crafted message file, Outlook can connect to an attacker-controlled network location without its usual external-content warning, disclosing the user's NTLMv2 hash — which the attacker can then use to authenticate as that user. The Preview Pane is not an attack vector. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, with a remediation deadline of November 24, 2026, for US federal agencies.
The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Microsoft credits the discovery to a researcher using the moniker "nono" and Benoît Sevens, who used Claude, Anthropic's large language model, in the research. Microsoft has published no details of the attacks observed in the wild.
Investigation notes
Official anchor: Microsoft's Security Update Guide marks CVE-2026-124194 "Exploitation Detected," and CISA added it to the KEV catalog on November 10 with a due date of November 24, 2026. That deadline is the federal remediation date; other organizations should treat it as the practical patch-by date.
Detection angle: the behavioural signature is OUTLOOK.EXE opening an outbound SMB/NetBIOS connection (TCP 445/139) to a non-private address — a crafted message file making Outlook authenticate to an attacker-controlled location. No network indicators were published for the in-the-wild exploitation, so detection is behaviour-first.
Counting note: totals differ by source — about 1,093 Microsoft-assigned CVEs, 1,094 by SecurityWeek's count, and 1,342 entries once Chromium and open-source component fixes are included. The 1,093 figure is Microsoft's own count of its assigned vulnerabilities.
5. Xen Orchestra auth bypass actively exploited to hijack virtualization hosts
A critical authentication bypass in Xen Orchestra, tracked as VSA-2026-062, is being actively exploited in attacks that can grant administrator privileges and allow takeover of XCP-ng virtualization hosts. Xen Orchestra is a web-based management platform from French vendor Vates, used to manage XCP-ng virtualization environments. The flaw stems from how Xen Orchestra processes authentication tokens in REST API requests: by sending a specially crafted cookie (authenticationToken=j:%7B%7D) containing an empty JSON object, an attacker can trick the platform into retrieving an existing authentication token and logging them in as its owner — no credentials required.
Once inside, an attacker can act with admin privilege, and a Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root. Vates confirmed active exploitation on November 10 and published indicators of compromise, including connections to 91.211.251.112 on port 8001 and a Tor onion service on port 3333. The flaw was discovered by researchers Filip Magic and Christoffer Olsen of TDC NET Security. No CVE identifier or CVSS score has been assigned yet.
Vates has released patched xo-server packages 5.211.2 (stable) and 5.213.1 (latest). Initial reports cited Xen Orchestra 6.9.1 and 6.10.0 as the fixed releases, but the Vates advisory was later updated to list 6.9.2 (stable) and 6.10.1 (latest) — administrators should check the advisory for the current fixed build. Vates warns that successful exploitation leaves no log entry for the unauthenticated access, so detection must come from HTTP monitoring in front of Xen Orchestra, watching for requests containing the crafted cookie value.
Investigation notes
Official anchor: Vates advisory VSA-2026-062, published November 10, confirms active exploitation and lists IOCs. There is no CVE yet and no public exploit code mentioned in reporting — but the advisory and the public fix describe the mechanism in detail, so the barrier to exploitation is low.
Detection gap: the bypass generates no log entry on the Xen Orchestra side. The observable signal is at the HTTP layer: requests carrying authenticationToken=j:%7B%7D or authenticationToken=j:{}. Vates says most Xen Orchestra deployments are not internet-facing, which lowers the odds of exploitation — but any exposed instance needs urgent action: patch, take it off the internet until patched, and check for the IOCs.
Sources
- Japanese furniture giant Nitori says hackers stole 37.6M customer records — BleepingComputer
- Railway breach leads to $740,000 in fraudulent AI charges — BleepingComputer
- Barracuda ESG Vulnerability Exploited, PoC Exploit Public — SecurityOnline.info
- Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft — SecurityWeek
- November 2026 Microsoft Patch Tuesday — Tenable
- Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers — BleepingComputer
