Nitori warns data breach may have exposed up to 37.62 million customer records (2026)

On 9 November 2026, Nitori — the Sapporo-based Japanese furniture and home-furnishings giant that operates more than 870 stores across Japan and over 200 elsewhere in Asia — warned that a cyberattack may have exposed up to 37.62 million customer records held on its servers. The company said it had detected unauthorised access to one of its systems on 6 November and blocked it, but that an investigation found the intruder had likely enjoyed access since mid-October.

What happened

Nitori said an attacker reached a system on its network and "may have stolen" the personal information it held. The company has not described the intrusion method, saying only that it has since addressed vulnerabilities in its systems and strengthened its threat monitoring. In a follow-up notice it stressed that the figure of 37.62 million is an upper bound on the records potentially leaked, and that it has not yet determined how many individual customers are affected; the count could still change as the investigation continues.

What was exposed

The potentially affected data spans Nitori's individual members and purchasers — membership numbers, names, email addresses, postal addresses, phone numbers, dates of birth and gender — as well as corporate members' company, department and representative details, and order histories from Nitori Net and the retailer's official shops on third-party e-commerce marketplaces. Nitori stated that account passwords and credit-card information were not compromised, because those details are held separately.

Response and why it matters

Nitori said it had reported the breach to Japan's Personal Information Protection Commission and the police, and that it would notify affected customers directly. The company is still investigating the cause, including whether ransomware was involved, with the help of outside cybersecurity experts. With tens of millions of valid, brand-associated contact records potentially in circulation, the most immediate risk to customers is targeted phishing and fraud; Nitori warned that it would never ask for passwords, card numbers or PINs by email or phone.