Japanese furniture giant Nitori: data breach exposes 37.6 million customers

Full text

Nitori discloses cyberattack that may have exposed data from up to 37.6 million customer records

Stolen information included personal and business customer details, though passwords and payment data were unaffected

Company remediated the intrusion, continues investigating the breach, and warned users about phishing attempts

Japan’s largest furniture chain Nitori Holdings has disclosed suffering a cyberattack which saw it lose tens of millions of customer records.

Both consumer and business customers are affected, but passwords and payment data have not been compromised.

In a statement, Nitori said it spotted unauthorized access to its systems on November 6 2026 - and after ousting the intruder and launching an investigation, the company discovered that up to 37.6 million of customer records may have been exfiltrated, including people’s first and last names, membership numbers, email addresses, postal addresses, phone numbers, gender information, as well as birth dates.

Nitori's warning

Aside from these records, corporate members also had their company names and department names exposed, as well as names of company representatives, phone numbers, designated contact persons, and other details.

The specific combination of information varies from customer to customer, it said, adding that the data was most likely generated by Nitori Net and Nitori’s official stores on third-party e-commerce marketplaces. The company also stressed that credit card information and login credentials were not exposed.

The investigation is currently ongoing and crucial details are still missing. We don’t know who the threat actors are, or if they reached out demanding payment in exchange for deleting the stolen files.

Nitori also said it identified the flaws used to break in, remedied them, but was still analyzing and monitoring them.

“We have addressed the identified vulnerabilities and completed improvements to our monitoring systems”, it said.

“We are continuing to work with external specialists to investigate the cause of the incident, the method of intrusion, the extent of the impact, and whether any secondary damage has occurred.”

Often compared to IKEA, Nitori Holdings is considered Japan’s largest home furnishing retailer, selling affordable furniture, home accessories, kitchenware, and similar household products. It operates more than 1,000 stores across the region and 11 overseas markets, including China, Taiwan, South Korea, and a handful of Southeast Asian countries. Last year it reported $6.1 billion in revenue, while employing more than 41,000 people, and making almost 93 million customer purchases. Its mobile apps have more than 25 million registered members.

Those millions of members and thousands of employees are now being warned to pay attention to their inboxes for incoming email pretending to be from Nitori, or having to do something with the company and the breach.

“Personal information that may have been leaked could be misused for impersonation emails, phishing scams, suspicious telephone calls, and other fraudulent activities,” the company said in the announcement.

“We urge customers to exercise particular caution when receiving communications claiming to come from our company, delivery service providers, or e-commerce marketplaces.”

“Please do not open unfamiliar links or attachments.”

Japan under siege

There has been a barrage of cyberattacks against Japanese companies lately, with Iris Ohyama , a major Japanese consumer goods manufacturer, confirmed losing data on 7.7 million people in a data breach that affected its ecommerce website Iris Plaza.

Internet giant GMO also recently told its customers to unplug their devices from the network, after a cybercriminal threatened to release ransomware on user machines, and just before that gaming behemoth Capcom reported losing sensitive information on more than 11.7 million people. Most of them had their emails exposed, with a small subset also having to change their passwords.

Strangely enough, no threat actors claimed responsibility for any of these incidents. Usually, criminal organizations would try to extort money for the data, rather than trying to sell it on the black market, since some companies are more willing to pay. Leaking data could trigger class-action lawsuits or pressure from regulators and data watchdogs.

Via BleepingComputer