A data breach at Nitori Holdings, Japan's largest home retailer, may have leaked up to 37.62 million customer records. The disclosure came on 9 November 2026. Unauthorised access to a Nitori system was confirmed on 6 November, and outside specialists placed the intrusion in mid-to-late October. Email addresses, names, home addresses, phone numbers, dates of birth and member numbers fall within the data in scope. Login passwords and card data were not compromised. The total counts records, not confirmed unique people, and the company has not confirmed that any data was actually taken.
Disclosure#
Nitori Holdings published its notice on 9 November 2026. Kyodo News reported it in a daily digest. The Straits Times carried the same report. Nitori said a system it manages had been accessed without authorisation, confirmed on 6 November. Access was blocked, and outside specialists were brought in to investigate. Log analysis since then showed that a third party may have reached the system before 6 November, at some point in mid-to-late October. Nitori said the vulnerable point has been fixed, monitoring has been strengthened, and blocking of the attackers continues. What the weakness was, and how the attackers got in, has not been stated, and no start date more precise than mid-to-late October has been given. The incident has been reported to Japan's Personal Information Protection Commission, and Nitori is consulting the police and other relevant organisations. Affected customers will be contacted by email or post. Nitori also warned that the 37.62 million figure may change as log analysis and data matching continue.
The same day brought a second Japanese breach announcement. The Straits Times reported that Sega said on 9 November that about 2.2 million customer email addresses leaked after Arara, a contractor used to send newsletters, was compromised. The incidents are separate, but 9 November produced two email-address exposures in Japan.
Data in scope#
The scope reaches beyond registered members. It covers individual members, people who bought from the Nitori group without an account, corporate members, and orders placed through Nitori Net and Nitori's official shops on online malls. The data items differ by customer type:
| Customer group | Data that may have leaked |
|---|---|
| Individual members and purchasers | Member number, name (including the reading in kana), email address, home address, phone number, date of birth, gender |
| Corporate members | Member number, company name, department, representative's name, company address and phone number, contact person's name, email address and phone number |
| Orders | Orders placed through Nitori Net and Nitori's official shops on online malls |
Login passwords and credit card information were not included, so no Nitori account can be opened with a password from this incident and no card can be charged with details from it. The remaining data still supports impersonation. A message that names the customer, gives a real home address and phone number and refers to an order history is more convincing than a generic phishing message.
Up to 37.62 million is a record count, not a headcount. A single person can appear several times, as a member, as a one-time buyer and as an online-mall customer, and corporate contacts and orders are counted in the same total. Nitori has not stated how many unique individuals the records represent, or how the total divides between members, purchasers, corporate members and mall orders. TipRanks described the announcement in the same terms: up to 37.62 million records affected, covering names, contact details, addresses, birth dates, genders and order data, with passwords and credit card information excluded. Japan Cyber Watch, which tracks Japanese breaches, ranks it as the fourth-largest breach disclosed in Japan in 2026.
Customer groups in scope#
A person who bought furniture once and supplied a delivery address may appear in the data without ever creating an account, and may not think of themselves as a Nitori customer at all. A customer who ordered from a Nitori shop on an online mall dealt with the mall rather than with Nitori's own site, yet the order data is in scope. Nitori has not named the malls, and has not said what the order data contains beyond the order itself, for example delivery addresses or items purchased.
Corporate membership adds a business angle. The records hold the company representative and the named contact person, with company and personal contact details. Those details support targeted invoice fraud and payment-change scams as well as ordinary consumer phishing, so the exposure touches the named contact people at companies holding Nitori corporate accounts, not only individual shoppers.
Response from Nitori#
So far the response consists of the disclosure, the regulator report, police consultation and a customer warning. Nitori says the vulnerable point has been fixed and monitoring strengthened, and that blocking of the attackers continues. No technical detail has been published about the weakness, the affected system or the attack method, and nothing has been said about whether ransomware or extortion was involved. Japan Cyber Watch reported that, as of 9 November, it had not seen Nitori on leak sites tracked by ransomware.live, a negative observation from one tracker rather than a company statement.
The warning to customers is the most concrete part of the response. Customers were told to watch for messages pretending to come from Nitori, delivery companies or online malls, and Nitori said it will never ask for passwords, card numbers or PINs by email or phone. Affected customers will be contacted by email or post. A genuine Nitori message and an impersonation travel by the same channels, so the message itself cannot confirm its sender. The check is the route taken: Nitori's official site or a known contact route, rather than a link or a number inside the message.
Protective steps for customers#
The measures below follow from what leaked and what did not. They also follow Nitori's own warning and published guidance on breach response.
First, any message about a Nitori delivery, refund or order problem should be treated as unverified until it has been checked on Nitori's official site. Links in order-related emails or texts should not be followed, and a number supplied in such a message should not be called. Phishing built on leaked email addresses works because the message already knows the recipient's details. Familiarity is not evidence that a message is genuine.
Second, the email address used with Nitori can be checked against Have I Been Pwned, which lists breaches by email address and shows which incidents exposed it. The Nitori incident may not appear there yet, since the data has not been confirmed as taken, but the check covers the other breaches that may have exposed the same address. A fuller guide to the steps after a breach notice is in what to do when your email is in a data breach.
Third, password reuse remains the main account risk. No Nitori passwords leaked, but attackers try passwords from other leaks against the same brand after a breach announcement. How credential stuffing works explains the mechanism. Anyone who reused a Nitori password on another site should change it there, and turn on two-factor authentication on the Nitori account and on the email account itself where it is available.
Fourth, corporate customers should brief the named contact person on the account. Invoice fraud and payment-change requests that name the company, the representative and the contact person will look routine, so payment details should be verified through a known channel, not through contact details supplied in the message asking for the change.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Unanswered questions#
Much is still unknown. The attack route and the vulnerable point have not been disclosed. The start of the access, and the reason it went unnoticed until 6 November, have not been explained. The number of people behind the 37.62 million records, and the split between members, purchasers, corporate members and mall orders, has not been stated. The online malls involved have not been named, and the contents of the order data beyond the order itself have not been described. Whether the data left Nitori's systems, rather than only being possibly accessed, has not been confirmed. No confirmed misuse or fraud has been reported so far.
A follow-up disclosure is the next source of answers. Until then, the confirmed position is the one set out on 9 November: up to 37.62 million records may have leaked, the data is contact and order information rather than passwords or card details, and the company's response centres on a warning about phishing built on the exposed details.
Nitori's disclosure also continues a run of Japanese retail breaches covered on this blog. Bookoff disclosed in October that up to about 6.43 million member-number records may have been obtained, and the MUJI breach was reported in the same autumn run of Japanese retail disclosures.
