The Boardroom Brief Tuesday, November 10, 2026 · Maverick · 3-minute read |
The Membership File. |
A retailer counts tens of millions of customer records at risk, while a mailing vendor and a trust charter land the same day. |
Good morning. A retailer just put 37.62 million next to the words customer records. The board needs a named owner for notice, not another privacy-culture slide. Quick ask: who owns customer-notification after a supplier breach at your company? Reply with the role. I read every reply. |
Today in 30 seconds | ▪ | Nitori: says unauthorized access may have exposed up to 37.62 million customer records. |
| ▪ | SEGA: confirms 2.2 million newsletter emails leaked via a mailing vendor. |
| ▪ | Coinbase: says the OCC approved Coinbase National Trust Company as a federal trust. |
|
|
The Move A file that large turns a security incident into a customer-operations problem within hours. By Tuesday noon, have privacy and security list every system that holds name, address, phone and email together, name who drafts customer notice, and time how fast that draft reaches legal. Count the records before the press quotes. |
|
01 · Disclosure · Retail Nitori says up to 37.62 million customer records may have leakedOn Monday, November 9, Nitori Holdings said it found unauthorized access on November 6 and blocked it. Later checks pointed to possible mid-to-late October access. Up to 37.62 million records may have left its systems. For members and buyers that can include membership number, name, email, address, phone, birth date and gender, plus some corporate and order fields. Cards and passwords are out of scope. Customers get email or post notice as details firm up. Why it matters: This is a first public count. Treat the seven-digit figure as an operations timeline, not a headline. The notice still leaves open how many records left and whether any were misused. Source: Nitori Holdings notice |
02 · Vendors · Gaming SEGA says a mailing vendor exposed 2.2 million newsletter emailsAlso Monday, SEGA said Arara's messaging platform, used for some product and event newsletters, was breached. About 2,196,044 email addresses are in scope, including 92,273 with delivery metadata. SEGA Account emails on another system are out of scope. Names, phones, cards and passwords were not leaked, SEGA says. Arara had already disclosed the platform incident; Monday is SEGA naming its own customer count. Why it matters: A mailing vendor can hold a cleaner customer list than the identity system. Ask which campaign tools still get live exports, and who can cut that feed without waiting for a vendor statement. Source: SEGA notice |
03 · Custody · Banking Coinbase says the OCC approved its national trust companyOn Monday, Coinbase announced Coinbase National Trust Company as a federally chartered trust company and said the OCC approved it. That follows conditional OCC approval in April, when Coinbase said it was not becoming a commercial bank and would not take retail deposits. Its Monday materials put the charter next to federally supervised custody work for institutional clients. Why it matters: A federal trust charter does not end board oversight of custody sales. If your treasury uses Coinbase custody, ask which services now sit under the national trust and which stay on older licenses. Source: Coinbase announcement |
History rhymes 2007: TJX showed how large a retail file can getWhen TJX Companies disclosed a multi-year intrusion in 2007, the company figure landed near 45 million payment cards, with later bank filings arguing higher. Customer contact data still sits on systems that stores, marketing and vendors all touch. Today's Nitori count is a different country and a different mix, but the ownership question is the same. |
Put these to management | 1. | Which systems store name, address, phone and email together, and who can produce a clean notification list in 24 hours? |
| 2. | Which marketing or mailing vendors still receive live customer exports, and who can cut that feed? |
| 3. | If we use a federally chartered crypto custodian, which of our balances sit under that charter today? |
|
|
From the archive: Supply Chain Risk. An earlier Brief on how supplier paths become your incident. Read it beside today's customer-file counts. |
See you tomorrow at 7. Maverick Know someone who should be in the room? Forward this, or send them your link. Found this in Promotions or Spam? Drag it to your Primary tab so tomorrow's Brief lands where you will see it. The Boardroom Brief · daily at 7 a.m. ET · theboardroombrief.news |
