Japanese furniture and home goods retailer Nitori has disclosed a major cybersecurity incident that may have exposed up to 37.62 million customer records. The company discovered unauthorized access to one of its systems on November 6, 2026, but investigators believe the intrusion may have begun several weeks earlier.
Nitori Holdings announced the incident on November 9, warning that personal information belonging to individual customers, corporate members, and online shoppers could have been accessed by an unauthorized third party. The company has not confirmed that all potentially affected records were stolen, and the final scale of the exposure remains under investigation.
The retailer operates an extensive network of stores across Japan and other Asian markets. Nitori has 879 stores in Japan and another 219 locations across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong.
The potentially compromised information includes customer names, membership numbers, email addresses, residential addresses, telephone numbers, dates of birth, and gender. For corporate customers, the affected records may also contain company names, departmental information, business addresses, and contact details of company representatives.
Information associated with purchases made through Nitori Net and the company’s official stores on third-party e-commerce marketplaces may also have been exposed. The specific combination of personal information varies between customers.
Nitori emphasized that account passwords and credit card information were not included in the potentially compromised data. The company has not reported unauthorized payment transactions resulting from the incident.
Investigators identified signs of suspicious activity dating back to mid-to-late October, suggesting that attackers may have accessed the affected environment before the breach was detected on November 6. However, the company has not established the precise date of the initial intrusion or explained how the attackers entered its systems.
After discovering the unauthorized access, Nitori blocked the suspected attackers and began investigating the affected infrastructure with assistance from external cybersecurity specialists. The company also addressed identified vulnerabilities and strengthened its monitoring systems.
The investigation includes reviewing system logs and comparing records to determine how much information was accessible and whether the attackers obtained copies of the data. Nitori acknowledged that the estimated number of affected records could change as the investigation progresses.
The retailer has reported the incident to Japan’s Personal Information Protection Commission and consulted police and other relevant authorities. It is also preparing to contact affected customers individually through email or postal notifications.
Nitori warned that exposed contact information could be exploited in phishing emails, impersonation attempts, and fraudulent telephone calls. Criminals could potentially use genuine customer details or previous purchase information to make deceptive communications appear more credible.
The company clarified that it does not request passwords, credit card numbers, or personal identification numbers through unsolicited emails or telephone calls.