Nitori breach: personal information in up to 37.62 million records may have been leaked, including names, addresses, phone numbers and dates of birth
Nitori says up to 37.62M records may have leaked, including names, addresses, phone numbers and dates of birth. Passwords and card data were not included.
What happened
Nitori Holdings, the Japanese furniture and home-goods retailer, confirmed unauthorised access by a third party to a system it manages on November 6, 2026, and disclosed the incident in a notice on November 9. The company says it blocked the access, dealt with the vulnerable point in its systems and strengthened monitoring, and is investigating with outside specialists. Its log analysis has since found that a third party may also have accessed the system before it was detected, in mid to late October. On the investigation so far, Nitori says up to 37.62 million records of personal information held on its servers may have been leaked externally. That figure is an upper limit, not a confirmed count of records taken: the company says it may change as log analysis and data checks continue, and it has not said how the attacker first got in or who was responsible. Nitori operates 879 stores in Japan and another 219 across China, South Korea, Taiwan, Thailand, Singapore and Hong Kong. It has reported the incident to Japan’s Personal Information Protection Commission, is consulting the police, and says it will contact affected customers directly by email or post.
Who is affected
The notice covers individual members and purchasers of the Nitori group — including people who bought without an account, through official Nitori stores or online shops — corporate members, and orders placed through Nitori Net and Nitori’s official shops on e-commerce marketplaces. For individual members and purchasers, the information that may have been leaked is membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth and gender. For corporate members it is membership numbers, company names, department names, representatives’ names, company addresses and telephone numbers, and contact persons’ names, email addresses and telephone numbers. Order information for purchases through Nitori Net and the official marketplace shops is also in scope. The 37.62 million figure counts records, not people, and the company is clear about what is not in the data: registered members’ account passwords and credit card information were not included.
How serious
The concrete risk is targeted phishing and impersonation, not card fraud or direct account takeover. Nitori itself warns that the exposed information could be used in phishing attacks and scams, and the combination is well suited to it: a name, home address, phone number, date of birth and real order history let a scammer pose as Nitori, a delivery company or an online marketplace with a message about a real purchase, a delivery problem or a refund — and Nitori says it will never ask for a password, credit card number or PIN by email or phone, so any message that does is a fake. The corporate-member records add a business risk: named representatives and contact people with company addresses and phone numbers are targets for invoice and payment-change fraud. Because passwords and card details were not included, this data alone does not open a Nitori account or a bank card; the danger is a convincing lie built from real details, and it lasts as long as names, addresses and dates of birth stay current.
What to do now
If you have bought from Nitori — in a store, on Nitori Net, or through its shop on an online marketplace, with or without an account — watch for the company’s direct notification by email or post, and treat unexpected messages about deliveries, refunds or orders with care even when they quote your real name, address or order details. Check any such message by going to Nitori’s official site or the marketplace yourself, never through a link in the message, and never give a password, card number or PIN in reply to an email or phone call: Nitori says it never asks for them that way. No password change is forced by this incident, because member passwords were not included — but if your Nitori password is reused anywhere else, changing it remains good hygiene against unrelated leaks. Companies with Nitori corporate accounts should warn their named contact people about invoice and payment-change fraud and verify any change of bank details through a number they already hold.
Sources: BleepingComputer, “Japanese furniture giant Nitori says hackers stole 37.6M customer records,” November 10, 2026 · Japan Cyber Watch, “Nitori Data Breach: Up to 37.62 Million Records,” November 9, 2026