Nitori, a major Japanese retailer of furniture and home accessories, discovered that an attacker had accessed a system on its network and may have stolen 37.62 million customer records.
The intrusion was detected on November 6 and the company blocked the unauthorized access. However, an investigation into the incident revealed that the attacker likely had access to the system since mid-October.
Nitori, often referred to as the “IKEA of Japan”, is a leading furniture and home furnishings retailer that operates 879 stores in Japan and 219 other stores in China, South Korea, Taiwan, Thailand, Singapore and Hong Kong. The company has annual sales of $5.8 billion.
According to the company’s notification, the incident affects individual customers, member companies and non-members who placed orders in official Nitori stores and online stores.
“On November 6, 2026, we confirmed unauthorized access by a third party to a system managed by our company” (automatically translated) the company says in the notification
“Our investigation to date has revealed that up to 37.62 million records of personal information held on our servers may have been leaked externally.”
Potentially exposed information may include the following types of data:
- Individual members and purchasers: membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth and gender.
- Corporate Members: Membership numbers, company names, department names, representative names, company addresses and telephone numbers, and contact names, email addresses and telephone numbers.
- Online Orders: Order information for purchases through Nitori Net and official Nitori stores on e-commerce marketplaces.
The company clarified that registered member account passwords and credit card information were not exposed in this incident.
Nitori claims to have quickly blocked the attacker’s access, patched vulnerabilities in its systems, and increased threat monitoring to prevent similar incidents in the future.
The company warned potentially affected customers that compromised information could be exploited in phishing attacks and scam attempts, and urged them to exercise caution.
The announcement emphasizes that Nitori will never ask its customers for their password, credit card number or PIN via email or during telephone conversations.
Nitori informed the Japan Personal Information Protection Commission, the police and other relevant authorities, and promised to notify affected customers directly by email or mail.
BleepingComputer has reached out to Nitori to ask about the incident, and we will update this post when we hear back.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s happening with a 14-day read-only scan of Microsoft 365 or Google Workspace, without MX modifications.
