Nitori Data Breach: Up to 37.62 Million Records May Have Leaked, What Is Confirmed and What Businesses Should Check
Nitori Holdings says up to 37.62 million records of personal information may have leaked after a break-in confirmed on November 6, 2026. Here is what its filing confirms, what is unknown, and what businesses should check this week.
On this page 8 sections
Japanese home furnishings retailer Nitori Holdings says an attacker got into one of its systems and that up to 37.62 million records of personal information may have leaked. It matters to any business holding customer data in one place, because names, addresses and order details are what make a fake invoice or delivery message look real, even with no passwords or card numbers involved.
What happened in the Nitori data breach
Nitori published its notice in a stock exchange filing on Monday, November 9, 2026. According to that filing, the company confirmed unauthorized access to a system it manages on Friday, November 6. It says it blocked the access immediately and began investigating with outside specialists.
Log analysis carried out afterward found that a third party may also have accessed the system in mid to late October. In other words, the intruder may have had a way in for weeks before the company noticed.
Nitori says it has dealt with the vulnerable points and finished strengthening its monitoring. The investigation into the cause, the route of entry, the scope and any secondary harm is still running. The company says it is reporting to and consulting with Japan's Personal Information Protection Commission and the police. It also says the effect on its consolidated earnings is still under review but is expected to be limited.
What data was exposed in the Nitori breach
The filing lists three groups. The combination of data differs from one customer to the next.
| Who | What may have been exposed |
|---|---|
| Individual members and buyers from Nitori Group | Member number, name (including phonetic reading), email address, home address, phone number, date of birth, gender |
| Corporate members | Member number, company name, department, representative's name, company address and phone number, contact person's name, email address and phone number |
| Customers who ordered through Nitori Net or official Nitori shops on online marketplaces | Order data (the filing does not list the specific fields) |
Nitori states that login passwords and credit card information are not part of the data that may have leaked.
Nitori cyberattack: what is confirmed and what is not
Stated as fact by Nitori:
- Unauthorized access to a company system was confirmed on November 6, 2026, and blocked.
- Login passwords and credit card information are not included.
- Weak points have been addressed and monitoring strengthened.
- Regulators and police are being informed.
Stated by Nitori only as a possibility:
- That up to 37.62 million records left the company. This is a ceiling, and the filing says the scope and count may change as log analysis continues.
- That a third party had access in mid to late October. Be careful with any report that presents this as settled, because the filing says only that it is possible and that the details are still being investigated.
Not known from the filing:
- How the attacker got in, or which system was involved.
- Who was behind it. The filing names no attacker and does not mention ransomware or a ransom demand.
- How many individual people the figure represents. The filing counts records, and it does not split them between individual and corporate members.
- Whether the data has been misused. Secondary harm is still under investigation.
Is my Nitori account affected? What customers should do
Nitori says it will contact affected customers in stages by email or postal mail. Until then:
- Expect scams. Nitori warns that the data could be used for spoofed emails, phishing and suspicious phone calls, including messages posing as Nitori, delivery companies or online marketplaces. Do not open unexpected links or attachments.
- Know what Nitori will not ask for. The company says it will not ask for passwords, credit card numbers or PINs by email or phone.
- Use the official contact route. Nitori's customer line in Japan is 0120-209-993, open 10:00 to 20:00 on weekdays, weekends and holidays. Do not reply to the contact details in a suspicious message. Nitori asks people to use the contact point published on its official website.
Why the Nitori breach matters for businesses
Three points stand out, and these are our reading rather than anything Nitori has said.
Business accounts are in scope. If your company buys from Nitori on a corporate account, a named employee's email address and phone number may be in this data, along with the company's department and order details. That is good raw material for a fake delivery notice or a request to change payment details.
Contact data alone is valuable. No passwords or card numbers does not mean no risk. A message that quotes a real address and a real order is far harder to dismiss.
Detection took time. If the October access is confirmed, the gap between entry and discovery was measured in weeks. Your logs need to reach back far enough to answer the same question, or you will not be able to say what was taken.
What to do this week
The steps below draw on the US Federal Trade Commission's guides on protecting personal information and responding to a breach.
| Action | How to check it is done |
|---|---|
| Warn staff named on any Nitori corporate account | They know to expect fake delivery, invoice or account messages |
| Verify any change to bank or payment details | Call back on a number you already hold, never one from the message |
| Take stock of personal data | You have a list of every system holding customer data and who can reach it |
| Scale down | Data with no business need is deleted, and retention periods are written down |
| Limit access | Staff and service accounts reach only what their job requires, and old accounts are removed |
| Centralize security logs | You can review activity from a month ago. We suggest keeping at least 90 days; the FTC guide sets no period |
| Watch outgoing traffic | An alert fires on unexpectedly large transfers to an unknown destination |
| Plan your response | A forensics contact and a law enforcement contact are named before you need them |
| Tell customers how you will contact them | Your notices state what you will never ask for, as Nitori's did |
Nitori data breach questions people are asking
Was my password stolen in the Nitori breach?
Nitori says login passwords are not part of the data that may have leaked.
Were credit card numbers leaked in the Nitori data breach?
Nitori says credit card information is not included.
How many people were affected by the Nitori data breach?
That is not known. Nitori gives a maximum of 37.62 million records, not a count of people, and says the number may change.
When did the Nitori cyberattack happen?
Nitori confirmed the access on November 6, 2026, and says earlier access may have taken place in mid to late October.
Who hacked Nitori?
The filing does not name anyone. The cause and the route of entry are still being investigated.
How will Nitori contact affected customers?
By email or postal mail, in stages. It says it will not ask for passwords, card numbers or PINs by email or phone.
Does the Nitori breach affect companies outside Japan?
The filing gives no breakdown by country. Any company with a Nitori corporate account should assume its contact details could be included until told otherwise.
The bigger lesson
The size of this incident comes from concentration: one system, up to 37.62 million records. Nitori says the investigation will inform a review of its access controls, authentication and permissions, and monitoring. Those are the same controls worth checking before an incident forces the question. Know what you hold, keep less of it, limit who can reach it, and make sure you can see when it starts to move.
Want those controls reviewed on your own systems? See our security hardening services or request a quote.
Get security alerts by email, with the free checklist, at our security alerts page.
Sources: Nitori Holdings stock exchange filing, November 9, 2026 (Japanese); FTC, Protecting Personal Information: A Guide for Business; FTC, Data Breach Response: A Guide for Business; The Star, carrying Reuters.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Fireworks AI Breach: A Cloud Provider Incident Reached Billing Records, Datasets and Model Weights, and What Customers Should Do This Week
Fireworks AI has expanded its October security incident. An attacker went through a third-party cloud provider...
React Server Components Vulnerability GHSA-xqc2-xf4c-x3h3: Critical Code Execution Flaw Hits Next.js 16 Cache Components, and the Fixed Versions to Install
A critical React Server Components flaw can let attackers with no login run code on a web server in rare app p...
Plerdy Tracker Hack: How APT29 Turned an Analytics Script Into a Watering Hole, and How to Check the Third-Party Scripts on Your Website
For one week, attackers changed the Plerdy analytics script so websites using it checked every visitor's phone...
