Nitori Holdings, Japan's largest furniture retailer, says an unauthorized intruder may have stolen up to 37.62 million customer records after gaining access to a company system in mid-October and going undetected until November 6.
Nitori Holdings, Japan's largest furniture and home goods retailer, disclosed on November 10 that an unauthorized third party accessed one of its systems and may have exfiltrated up to 37.62 million customer records — one of the largest data breaches reported by a Japanese retailer to date.
The breach, first reported by BleepingComputer, was detected on November 6, when the company identified and blocked the unauthorized access. An internal investigation subsequently found that the attacker likely had access to the compromised system since mid-October, suggesting a roughly three-week period of potential data exposure.
"On November 6, 2026, we confirmed unauthorized access by a third party to a system managed by our company," Nitori said in a machine-translated notification. "Our investigation to date has revealed that up to 37.62 million records of personal information held on our servers may have been leaked externally."
The compromised data spans several customer categories. For individual members and purchasers, the exposed information may include membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth, and gender. Corporate members face potential exposure of company names, department names, representative names, company addresses, telephone numbers, and contact persons' names and email addresses. Online order records from Nitori Net and official Nitori storefronts on third-party e-commerce platforms are also potentially affected.
The company said account passwords and credit card information were not exposed.
Nitori operates 879 stores across Japan and an additional 219 locations in China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong. The company, which is frequently compared to IKEA in coverage of Japan's retail market, reported annual revenue of $5.8 billion.
Following the detection of the intrusion, Nitori said it blocked the attacker's access, patched the vulnerabilities exploited in the attack, and reinforced its threat monitoring capabilities. The company also notified Japan's Personal Information Protection Commission, police, and other relevant authorities, and said it would contact affected customers directly by email or post.
Nitori warned that the stolen data could be used in targeted phishing campaigns and fraud attempts against affected individuals. The company emphasized that it would never request passwords, credit card numbers, or PINs from customers via email or phone — a standard caution aimed at limiting social-engineering exploitation of the breach.
The incident adds to a string of significant data breaches at Japanese consumer-facing companies in recent years, reinforcing scrutiny of how major retailers in the country store and safeguard personal information at scale.
With tens of millions of records potentially in circulation, affected customers across six countries and territories face an elevated risk of credential-stuffing attempts and targeted scams in the weeks ahead, security analysts warn.
Sara Montes de Oca is the Editor in Chief of TechEchelon. Previously a correspondent and producer in Washington, D.C., covering business, finance, and politics.
More from Sara →A wave of cyberattacks on European supermarket refrigeration systems, hoax bomb threats against passenger flights, and suspected sabotage incidents last week exposed significant vulnerabilities in civilian infrastructure across the continent.
French cooperative bank Crédit Mutuel Arkéa suffered a cyberattack that enabled fraudulent transactions of up to $133 million after an attacker gained access through a third-party service provider and converted funds into cryptocurrency.
Chainalysis confirmed that attackers obtained names, usernames, password hashes, and live authentication tokens for all users on its platform in a "multifront cyberattack," with clients including the FBI, ICE, and Microsoft among those affected.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.