Skip to main content
IMMUNITYSEC
Threat Intelligence News & Analysis

Japanese furniture retailer Nitori says breach may have exposed up to 37.62 million customer records

2026-11-113 min read

Nitori Holdings, the Japanese furniture and home goods retailer, said on November 9, 2026, that up to 37.62 million personal information records may have leaked after a third party gained unauthorized access to a system it manages. The records include names, addresses, phone numbers, email addresses, and dates of birth, but not login passwords or credit card information. Nitori confirmed the access on November 6 and said a third party may have accessed the system as early as mid to late October.

Key Takeaways

  • Nitori Holdings said on November 9, 2026, that up to 37.62 million records of personal information held on its servers may have leaked after unauthorized access to a system it manages.
  • The Nitori records include membership numbers, names, email addresses, postal addresses, phone numbers, dates of birth, and gender, plus corporate member contacts and online order data; Nitori said login passwords and credit card information were not included.
  • Nitori confirmed and blocked the unauthorized access on November 6, 2026, and its later log analysis found that a third party may have accessed the system as early as mid to late October 2026.
  • As of November 11, 2026, Nitori was still investigating the cause of the breach, including whether ransomware was involved, and had not determined how many customers were affected, a spokesperson told BleepingComputer.

What happened

Nitori Holdings, a Japanese furniture and home furnishings retailer, said on November 9, 2026, that it had confirmed unauthorized access by a third party to a system it manages. Up to 37.62 million records of personal information held on its servers may have leaked, the company said in a notice (in Japanese). BleepingComputer, The Star, and INTERNET Watch reported the same figure.

Nitori found the unauthorized access on November 6, 2026, immediately blocked it, and began investigating with outside specialists, according to the notice. Log analysis after that date found that a third party may have accessed the system in mid to late October, Nitori said. The Star and INTERNET Watch reported the same timeline.

Nitori operates 879 stores in Japan and another 219 in China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong, BleepingComputer reported.

What data was exposed

According to Nitori, the records that may have leaked cover individual members of the Nitori Group and people who bought its products. For them, the data includes membership numbers, names with their phonetic readings, email addresses, postal addresses, phone numbers, dates of birth, and gender.

For corporate members, the data includes membership numbers, company names, department names, representatives' names, company addresses and phone numbers, and the names, email addresses, and phone numbers of contact persons, Nitori said. Order data for purchases through its Nitori Net online store and its official shops on online marketplaces is also affected. The combination of data differs from customer to customer, the company said.

Login passwords and credit card information were not among the data that may have leaked, according to Nitori. BleepingComputer and The Star reported the same.

Response and what is unknown

Nitori said it is still blocking the attacker's access, has fixed vulnerable points in its systems, and has finished strengthening its monitoring. It is investigating the cause, how the attacker got in, the scope of the breach, and whether any further harm has followed, with outside specialists. The number of records and the scope may change as log analysis and data matching continue, the company said.

The company is reporting the incident to Japan's Personal Information Protection Commission and the police, according to its notice. It said it will contact affected customers by email or post.

On November 11, a Nitori spokesperson told BleepingComputer that the company was still investigating the cause, including whether ransomware was involved, and had not yet determined the number of customers affected.

Nitori is the latest Japanese company to report a possible data breach, The Star reported. On the same day, the game company Sega said about 2.2 million customer email addresses had leaked after a contractor it used to send newsletters was compromised, according to The Star.

What Nitori advises customers

Nitori warned that the leaked information could be used in spoofed emails, phishing scams, and suspicious phone calls. The company asked customers to be careful with messages that claim to come from Nitori, delivery companies, or online marketplaces, and not to open links or attachments they do not recognize.

Nitori said it never asks for passwords, credit card numbers, or PINs by email or phone. Customers who receive a suspicious message should not reply to the contact details in it and should instead use the inquiry contacts listed on Nitori's official website, the company said.