Japanese home furnishings retailer Nitori Holdings said on Nov. 9 that up to 37.62 million customer records may have been exposed after a third party gained unauthorized access to its systems. The company says login passwords and credit card data are not part of the exposure, but names, contact details and dates of birth are, which makes phishing the main risk.
What happened
Nitori says it discovered the unauthorized access on Nov. 6, blocked it right away and brought in outside specialists to assess the damage. Log analysis then pointed to possible earlier access by a third party in mid to late October. Reuters, as carried by the Straits Times, describes an outside investigation finding that the breach happened in that window, while Nitori’s own notice still frames the earlier access as something under investigation.
The company says it has fixed the weak points the attacker used and finished strengthening its monitoring. It is reporting to Japan’s Personal Information Protection Commission and the police, and plans to contact affected customers by email or postal mail in stages. Nitori also cautioned that the record count could change as log analysis and data cross-checking continue.
Who is affected
The exposure covers several groups, and the mix of data differs by customer:
- Individual members and purchasers across the Nitori Group: member number, name (with furigana reading), email address, home address, phone number, date of birth and gender.
- Corporate members: member number, company name, department, representative’s name, company address and phone number, plus the contact person’s name, email and phone number.
- Online orders: order information for people who bought through Nitori Net and Nitori’s official shops on online shopping malls.
Nitori states that login passwords and credit card information were not included. The data set is large enough that it matters well beyond Japan’s borders for anyone who shops with the brand or handles accounts for a business that does.
Why it matters
Even without passwords or card numbers, a record that pairs a real name with an address, phone number, email and birth date is useful to scammers. Nitori itself warns the data could fuel spoofed emails, phishing and suspicious calls, including messages posing as Nitori, delivery companies or online malls. Corporate member records add named contacts at real companies, which is our analysis of why business customers should expect convincing invoice or delivery lures.
What to do
- Do not open unfamiliar links or attachments, and be wary of any message or call claiming to come from Nitori, a courier or a shopping mall. Nitori says it will never ask for passwords, card numbers or PINs by email or phone.
- If something looks suspicious, do not reply to the contact details it gives. Use the inquiry desk listed on Nitori’s official website instead.
- Watch for Nitori’s own notice by email or mail, and treat any notice that arrives through a different channel with caution.
- Our analysis: if you reuse a Nitori password anywhere else, changing it is a cheap precaution, even though the company says passwords were not exposed.
- Our analysis: business members should confirm any payment or bank-detail change through a phone number or contact they already have on file.
What we still do not know
- Whether “37.62 million records” means 37.62 million people or a count of data entries. Nitori’s announcement uses the word records.
- The final number of affected people, which the company says may change.
- How the attacker got in, and what happened during the October access.
- Who is responsible. Nitori has not named an attacker, and we did not find a public claim of responsibility in the reports we reviewed.
- Whether the data has been posted or sold.
Sources: Impress Watch, Nov. 9, 2026 (Japanese); SmartScope summary of Nitori’s notice, Nov. 9, 2026; The Star (Reuters/Straits Times), Nov. 9, 2026; SC Media brief, Nov. 11, 2026.
Leave a Reply