Overview
Nitori, a major Japanese furniture and home accessories retailer, disclosed that an attacker accessed a system on its network and may have stolen up to 37.62 million customer records. BleepingComputer reported the disclosure on 2026-11-10.
Timeline
- Mid-October 2026: Nitori's investigation indicates the attacker may have had access from this point.
- 2026-11-06: Nitori detected and confirmed unauthorized third-party access.
- 2026-11-10: Public disclosure.
Data Involved
Individual members and purchasers
- Membership numbers, names, email and postal addresses, phone numbers, dates of birth and gender
Corporate members
- Company, department and representative names, addresses, phone numbers and contact details
Online orders placed via Nitori Net and official marketplace stores are also in scope.
Nitori says account passwords and credit card information were not exposed.
Response
Nitori blocked the access, addressed the vulnerabilities involved, and strengthened threat monitoring. It notified Japan's Personal Information Protection Commission and the police, and plans to contact affected customers by email or post. The company has not publicly detailed the entry point or named a threat actor, and BleepingComputer's request for more detail was still pending.
What Customers Should Do
- Expect phishing and scam messages that use real names, addresses and order details. Treat unsolicited emails, texts and calls claiming to be from Nitori with suspicion.
- Do not click links in messages about orders or accounts. Go to the official site directly.
- Although passwords were reportedly not exposed, consider changing them if reused elsewhere.
Takeaways for Defenders
Large retail customer databases are persistent targets, and a roughly three-week window between intrusion and detection is common. Segment customer data stores, monitor for bulk exports, and keep regulatory notification playbooks current.