Nitori says outsider may have copied 37.62 million customer records

Nitori Holdings disclosed on Nov. 10, 2026 that an intruder may have copied up to 37.62 million customer records after entering a system on its network.

The company said its investigation showed the intruder probably gained entry starting in mid-October 2026, leaving a possible exposure window of about three weeks. It detected the intrusion on Nov. 6, 2026, and blocked the unauthorized access. “On November 6, 2026, we confirmed unauthorized access by a third party to a system managed by our company,” Nitori said.

“Our investigation to date has revealed that up to 37.62 million records of personal information held on our servers may have been leaked externally,” Nitori said. BreachHistory says the figure counts individuals more than once when they appear multiple times. BreachHistory also states that the method the intruder used to get in first has not been published.

For individual members and purchasers, exposed information may include membership numbers and names plus e-mail addresses, mailing addresses, phone numbers, birthdates and gender. Exposed information for corporate members may cover membership numbers and firm names along with departments, representative names, business addresses and phone numbers, contact names, e-mail addresses and phones. Order information tied to purchases on Nitori Net and on Nitori’s official storefronts on third-party e-commerce sites may also be involved.

Affected parties include individual shoppers, business members and non-members who bought through official Nitori stores and the company’s online shops. Its footprint spans 879 locations in Japan and another 219 locations across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong.

TechEchelon describes Nitori Holdings as Japan’s largest furniture and home goods seller, and Japan’s retail-market coverage often compares Nitori to IKEA. The company said its annual revenue totaled $5.8 billion.

The outlet describes the breach as one of the largest retail data leaks a Japanese company has ever disclosed. The outlet says the episode adds to a recent pattern of serious breaches at Japanese consumer businesses, heightening scrutiny of retailer data protection at scale.

Nitori said the exposed details might fuel phishing schemes and fraud attempts aimed at affected customers. Security analysts cited by TechEchelon warn that shoppers in six countries and territories face increased odds of credential-stuffing attacks and targeted scams over the coming weeks. Phishing uses fraudulent messages to trick people into revealing personal data. Credential-stuffing attacks try stolen usernames and passwords on other websites and services.

It will not ask for passwords, credit card numbers, or PINs by e-mail or phone, Nitori said. Nitori said it cut off the intruder’s access, fixed vulnerabilities, and stepped up threat monitoring. It notified Japan’s Personal Information Protection Commission, the police, and other relevant authorities. Nitori said it will contact affected customers directly by e-mail or mail.