Nitori Data Breach: Up to 37.62 Million Records, What Leaked

Nitori, the Japanese home furnishings retailer often described as the country’s answer to IKEA, has told customers and regulators that up to 37.62 million records of personal information held on its servers may have been leaked externally. The company’s own disclosure, filed through Japan’s TDnet system on November 9, 2026, is the source for that figure.

The number is large, and the details matter more than the headline: some of the most damaging categories of data, including account passwords and credit card numbers, were not part of the exposure according to the company.

What Nitori says happened

Nitori says it confirmed unauthorised access by a third party to a system it manages on November 6, 2026, and blocked that access. Its investigation to date indicates the attacker may have had access from mid-October. The company says it has reported the incident to Japan’s Personal Information Protection Commission and to police, and that it will contact affected customers directly by email or post.

BleepingComputer’s report, published November 10, notes that Nitori operates 879 stores in Japan and another 219 across China, South Korea, Taiwan, Thailand, Singapore and Hong Kong. On November 11 it added that a Nitori spokesperson said the company is still investigating the cause, including whether ransomware was involved, and has not yet determined how many customers are affected.

What may have been exposed

The company’s notice divides the possible exposure into three groups:

Individual members and purchasers: membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth and gender.
Corporate members: membership numbers, company names, department names, representatives’ names, company addresses and telephone numbers, plus contact people’s names, email addresses and phone numbers.
Online orders: order information for purchases made through Nitori Net and official Nitori shops on e-commerce marketplaces.

Nitori states that registered members’ account passwords and credit card information were not exposed in this incident. That is a meaningful limitation on the risk, but it is not the end of the story: the combination of name, address, phone number, date of birth and purchase history is exactly the material a convincing impersonation call needs.

Why this data is worth stealing even without card numbers

Order history tells a fraudster what you bought, when, and where it was delivered. That is enough to open a phone call with “I’m calling about your delivery” and sound credible. Dates of birth and phone numbers help with identity-verification questions at other companies that treat them as secrets.

Nitori’s notice makes a point of saying the company will never ask for your password, credit card number or PIN by email or over the phone. Treat that as the rule for every retailer, not just this one. Our guide to the first 24 hours after a data breach walks through the practical order of operations.

What to do if you have ordered from Nitori

Expect contact, but verify it independently. Nitori says it will reach customers by email or post. Do not use a link or phone number from an unexpected message; go to Nitori’s own site or app and find the notice there.
Watch for delivery-themed phishing. A message that knows your order details is not proof it came from the retailer. Delivery scams are the most common follow-on to retail breaches.
Reuse habits matter more than the leak. If you used the same email and password at Nitori as anywhere else, change the password at those other services and turn on two-factor authentication there.
Be sceptical of refund and “compensation” offers. A breach is a reliable hook for fake refund calls, especially where a retailer has publicly promised to contact customers.

What is still unknown

Nitori has not named an attacker, has not confirmed whether ransomware was involved, and has not published a final count of affected customers. Any claim that a specific group is responsible, or that the figure is final, is speculation at this point. We will not repeat one.