Nitori says breach may expose up to 37.6M customer records

Japanese furniture and homeware giant Nitori disclosed on November 9 that an intruder accessed its systems and that up to 37.62 million customer records may have been leaked externally. Nitori detected the unauthorized access on November 6 and blocked it the same day. No group has claimed responsibility, and the company has not attributed the intrusion.

The primary source is Nitori's own breach notice (Japanese, machine-translated); it is corroborated by BleepingComputer and, via Reuters, The Star.

What was exposed

Nitori says the records are personal information held on its servers that "may have been leaked externally." The 37.62 million figure is an upper bound, not a confirmed count — a company spokesperson told reporters on November 11 that Nitori had not yet determined how many customers were actually affected.

Exposed data, per Nitori's notice:

• Individuals: membership numbers, names, email and postal addresses, phone numbers, dates of birth, and gender.
• Corporate members: membership and representative details, company addresses and phone numbers, and contact-person names, emails, and phone numbers.
• Orders: order information from Nitori Net and official Nitori shops on e-commerce marketplaces.

Not affected, per Nitori: account passwords and credit card information.

Timeline and status

• Mid-October 2026 — attacker likely gained access, per Nitori's third-party investigation.
• November 6 — Nitori detects the access, blocks it, and says it patched the vulnerabilities it found.
• November 9 — public disclosure.
• Nitori notified Japan's Personal Information Protection Commission and the police, and says it is investigating the cause — including whether ransomware was involved — with external cybersecurity experts.

Nitori has not disclosed the initial access vector, the exploited product, or which regional operations are affected.

Action checklist

If you hold a Nitori account:

1. Expect targeted phishing. With names, addresses, phone numbers, and purchase history in play, lures will be convincing and Nitori-branded. Treat unsolicited "account verification" and "delivery problem" messages as hostile.
2. No password reset is forced, since Nitori says passwords weren't exposed — but if you reused that password anywhere, rotate it there.
3. Watch bank and card statements. Card data wasn't in the exposed set per Nitori, but order and contact data still enables social-engineering fraud.
4. Verify any "Nitori" contact out of band — through the official app or website, never a link in an inbound message.

Context

Nitori joins a run of large Japanese consumer-data incidents: Iris Ohyama's cloud breach hit 7.7M customers, and Asahi disclosed theft affecting roughly 2 million people earlier this cycle. Nitori itself weathered a 2022 credential-stuffing attack on its app that exposed around 132,000 accounts — a separate, smaller event. The open question here is the vector: until Nitori names it, treat the "mid-October to November 6" window as the exposure period and assume the data is out.