Image: Wikimedia Commons / Tokumeigakarinoaoshima, CC BY-SA — a Nitori mall in Higashiosaka, Japan (illustrative image of a Nitori store, not the breached system).
TL;DR: The Nitori data breach explained in short: Japan's largest furniture retailer disclosed on 9 November 2026 that unauthorised access found on 6 November may have exposed up to 37.62 million customer records — names, addresses, phone numbers, emails and dates of birth. Login passwords and card data were not included, the company says. If you have ever bought from Nitori, expect phishing messages trading on the breach and do not click links in unexpected emails.
📌 KEY HIGHLIGHTS
- Nitori Holdings disclosed on Monday, 9 November 2026 that unauthorised access to a system it manages may have leaked up to 37.62 million records of personal data.
- The access was found on 6 November and blocked the same day; log analysis shows the attackers may have been inside since mid to late October.
- Exposed data may include member numbers, names, email addresses, home addresses, phone numbers, dates of birth and gender — plus corporate member details and order data from Nitori Net and Nitori's official shops on online malls.
- Login passwords and credit card data were NOT included, Nitori says, and the figure is a count of records, not people — it may change as the investigation continues.
- Nitori has reported the incident to Japan's Personal Information Protection Commission, is consulting the police, and will contact affected customers by email or post.
What happened in the Nitori data breach?
Nitori Holdings, Japan's largest furniture and home goods retailer, said on 9 November 2026 that a third party gained unauthorised access to a system it manages. The company found the access on Friday 6 November, blocked it the same day, and began an investigation with outside specialists.
Log analysis since then has pushed the start of the incident back: Nitori says the attackers may have accessed the system as early as mid to late October — up to three weeks before the intrusion was noticed. The company says it has fixed the "vulnerable point" the attackers used and strengthened monitoring, but it has not said what the weakness was or how the attackers got in.
| Date | Development |
|---|---|
| Mid to late Oct 2026 | Unauthorised access to Nitori's system may have begun, according to later log analysis |
| 6 Nov 2026 | Nitori confirms the unauthorised access, blocks it the same day, and starts an investigation with outside specialists |
| 9 Nov 2026 | Nitori discloses that up to 37.62 million records may have leaked; reports to the Personal Information Protection Commission and consults the police |
What data may have leaked — and what was not
The scope is wider than a typical membership breach, because one system appears to hold customers from every sales channel — members, one-time buyers, businesses and shoppers who ordered through other companies' online malls.
| Group | Data that may have leaked |
|---|---|
| Individual members and people who bought from the Nitori group | Member number, name (including the reading in kana), email, address, phone number, birth date, gender |
| Corporate members | Member number, company name, department, representative's name, company address and phone number, contact person's name, email and phone number |
| Orders | Order data from Nitori Net and Nitori's official shops on online malls |
Two things were not in scope, according to Nitori: login passwords and credit card data. The 37.62 million figure is a count of records, not people — the same person can appear in more than one group — and Nitori warns the number may change as log analysis and data matching continue. It is also not yet confirmed that data was actually taken, only that it may have been; and as of 9 November, Nitori has not appeared on ransomware leak sites tracked by researchers.
Image: Wikimedia Commons — a Nitori furniture store in Shenzhen, China (illustrative image of a Nitori store).
Why the Nitori data breach matters
At up to 37.62 million records, this is the fourth-largest breach disclosed in Japan this year, according to Japan Cyber Watch's running list — and it lands in the middle of a record wave of Japanese corporate breaches. Trend Micro figures reported on 9 November put publicised cyberattacks and corporate data breaches in Japan at 233 in October alone, a monthly record, with roughly 185 million pieces of personal information leaked in that month. Researchers link the surge in part to autonomous AI agents being used to carry out intrusions.
The Nitori case also shows why a single customer system is a single point of failure: members, one-time buyers, corporate accounts and orders placed through other companies' malls all sat in the same scope. Shoppers who ordered from a Nitori shop on an online mall may never have thought of themselves as Nitori's customers — yet their order data is included. For businesses, the corporate member records — named representatives and contact people — are exactly the details used in business email compromise and invoice fraud.
Nitori has been expanding across Asia, including a first India store announced for Mumbai in 2024, so the breach is worth attention well beyond Japan — and the pattern of October's Japanese breaches, from retailers to brokerages, is now a regional story, not a one-company incident.
What to do if you have ever bought from Nitori
Nitori says it will contact affected customers by email or post, and it warns customers to watch for messages pretending to come from Nitori, delivery companies or online malls. The company says it will never ask for passwords, card numbers or PINs by email or phone.
- Do not click links in unexpected messages: any email or text about deliveries, refunds or the breach itself should be checked on Nitori's official site, not through a link in the message.
- Do not reuse passwords: no passwords leaked here, but breach announcements draw credential-stuffing attacks — attackers try passwords stolen in other leaks against the same brand. Use a unique password for your Nitori account and switch on two-step sign-in if it is offered.
- Warn your accounts team: if your company holds a Nitori corporate account, alert the named contact people about invoice and payment-change fraud.
- Watch for impersonation: expect phishing that uses your real name, address and order history — the leaked fields make fake delivery and refund messages far more convincing than usual.
- Monitor accounts: check bank and card statements for unfamiliar activity, and report suspicious messages to Nitori through its official channels.
Should you care?
✅ Verdict: act now if you have shopped at Nitori; take note everywhere else. If you have ever bought from Nitori — in store, online, or through an online mall — your name, address and phone number may be in the exposed data, and the phishing that follows is the real risk. Outside Japan the direct risk is lower, but the pattern matters: Japan's breach wave is now hitting its biggest retailers. Read our explainer on the SEC Philippines data breach for how leaked identity data gets reused, and the SM Entertainment data breach for what a leaked resident registration number means for victims.
FAQs
How many records were exposed in the Nitori data breach?
Nitori says up to 37.62 million records may have leaked. That is a count of records, not people — the same person can appear in more than one group — and the company warns the figure may change as its investigation continues.
What data was exposed in the Nitori breach?
Depending on the group, member numbers, names, email addresses, home addresses, phone numbers, dates of birth and gender for individual members and buyers; company and contact details for corporate members; and order data from Nitori Net and Nitori's official shops on online malls. Login passwords and credit card data were not included, according to Nitori.
When did the Nitori breach happen?
Nitori found the unauthorised access on 6 November 2026 and blocked it the same day, but log analysis suggests the attackers may have had access since mid to late October. The company disclosed the incident on 9 November 2026.
What should Nitori customers do now?
Do not click links in unexpected emails or texts claiming to be from Nitori, a delivery company or an online mall; use a unique password for your Nitori account; and watch for phishing that uses your real name, address and order history. Nitori says it will contact affected customers by email or post, and it never asks for passwords, card numbers or PINs by email or phone.
Takeaway
The Nitori breach is big, recent and still being measured — up to 37.62 million records, three weeks of possible undetected access, and no passwords or card data in scope. The danger for customers is not the leak itself but the phishing it enables: treat every message that knows your name and order history as suspect until you verify it on Nitori's official site.
If you have a Nitori account, check now whether its password is reused anywhere else — and change it today.
Sources
- Japan Cyber Watch — Nitori Data Breach: Up to 37.62 Million Records (9 Nov 2026)
- Nikkei — Nitori HD, up to 37.62 million customer records may have leaked in unauthorised access (9 Nov 2026)
- Impress Watch — Nitori, up to 37.62 million records may have leaked in unauthorised access (9 Nov 2026)
- TokyoReporter — Japan hit by record cyberattack wave (9 Nov 2026)
- TV Asahi (Super J Channel) — Potential Data Breach at Nitori: Up to 37.62 Million Records (9 Nov 2026)
Comments
Post a Comment