Nitori says up to 37.62M customer records may have leaked

What happened

According to BleepingComputer, Nitori, a Japanese furniture and home accessories retailer, says a third party accessed a system it manages and that up to 37.62 million records of personal information “may have been leaked externally.” This is the company’s own statement, relayed by BleepingComputer. Theft is not independently verified, and the headline wording “stole” is stronger than the company’s “may have” language.

BleepingComputer reports that Nitori says it confirmed the unauthorized access on November 6, 2026, blocked it, and that its investigation indicates the attacker likely had access since mid-October. The company says it addressed vulnerabilities in its systems and strengthened threat monitoring. The report does not name the vulnerability or entry point, so these are not confirmed.

In an update dated 11/11, BleepingComputer reports that a Nitori spokesperson said the company is still investigating the cause, including whether ransomware was involved, with external cybersecurity experts. The spokesperson said the company has not yet determined the number of customers impacted, so the 37.62 million figure is a ceiling. No attacker or group has been named in the source.

BleepingComputer also reports that Nitori has informed Japan’s Personal Information Protection Commission, the police and other relevant authorities.

Am I affected?

According to Nitori’s notification as quoted by BleepingComputer, the incident covers individual customers, corporate members, and non-members who placed orders through official Nitori stores and online shops. Potentially exposed data, per the company:

• Individual members and purchasers: membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth and gender.
• Corporate members: membership numbers, company names, department names, representatives’ names, company addresses and telephone numbers, and contact persons’ names, email addresses and telephone numbers.
• Online orders: order information for purchases through Nitori Net and official Nitori shops on e-commerce marketplaces.

Nitori says account passwords of registered members and credit card information were not exposed. This has not been independently verified. Nitori says it will notify affected customers directly by email or post, so whether you are individually affected is not confirmed until you receive that notice.

What to do now

1. Wait for a direct notice from Nitori by email or post, and do not rely on unsolicited messages that claim to be about the incident.
2. Be cautious with emails, calls or messages that reference Nitori or your orders. Nitori warns that the exposed information could be used for phishing and scams.
3. Do not share your password, credit card number or PIN with anyone claiming to be Nitori. The company says it will never request them by email or phone.
4. If you manage a corporate Nitori account, alert your listed contact persons that their names, emails and phone numbers may be targeted by phishing.
5. Check for updates: Nitori’s investigation into the cause and the number of affected customers was still open as of the latest source.

Sources

• BleepingComputer: Japanese furniture giant Nitori says hackers stole 37.6M customer records