Nitori says hackers may have stolen 37.62 million customer records

Nitori, a Japanese furniture and home accessories retailer, said it detected the intrusion on 6 November 2026 and blocked the unauthorized access. Its investigation indicated that the attacker likely had access to the system since mid-October, according to BleepingComputer's report of the company's notification.

The company said up to 37.62 million records of personal information held on its servers may have been leaked externally. The potentially exposed data includes membership numbers, names, email addresses, postal and telephone numbers, dates of birth and gender for individual members and purchasers, company and contact details for corporate members, and order information for purchases through Nitori Net and official Nitori shops on e-commerce marketplaces. Nitori said account passwords and credit card information were not exposed.

Nitori said it has informed Japan's Personal Information Protection Commission and the police, and has promised to notify affected customers directly by email or post. It warned customers that the data could be used in phishing and scam attempts.

Why it matters A breach of this size exposes contact and order data that attackers can reuse in phishing and fraud aimed at Nitori customers, and corporate contacts at member companies are included. Security teams at retailers and their customers should expect targeted messages that cite order history or membership details. Investigators should note the gap of about three weeks between the reported start of access in mid-October and detection on 6 November 2026.