Nitori says up to 37.6 million customer records may have been stolen

Japanese home furnishings retailer Nitori Holdings says an attacker may have taken up to 37.6 million customer records in a cyberattack. The company detected unauthorized access to its systems on November 6, 2026, and said its investigation is ongoing.

The potentially exposed information varies by customer and may include names, membership numbers, email and postal addresses, phone numbers, gender information, and birth dates. For corporate members, it may also include company and department names, representatives’ names, phone numbers, designated contacts, and other details. Nitori said the data was likely generated through Nitori Net and its official stores on third-party e-commerce marketplaces.

Nitori said credit card information and login credentials were not exposed. It said it identified and fixed the vulnerabilities used in the intrusion and improved its monitoring systems. The company is working with external specialists to investigate the cause, method, scope, and any possible secondary damage. It has not identified the attackers or said whether they demanded payment.

The company warned that potentially leaked information could be used in impersonation emails, phishing, suspicious calls, and other fraud. It urged customers to be cautious with messages claiming to come from Nitori, delivery providers, or e-commerce marketplaces, and not to open unfamiliar links or attachments.