Nitori Holdings, Japan’s top home furnishings chain, announced a cyberattack that led to the theft of up to 37.6 million customer records, including personal but not financial data. The breach was detected November 6, 2026, prompting a comprehensive investigation and remediation.
- Over 37 million customer records exposed, excluding passwords and payment info
- Sensitive personal and corporate contact information compromised
- Investigation ongoing with vulnerability patches applied
What happened
On November 6, 2026, Nitori Holdings detected unauthorized access to its systems. Following swift action to expel the threat actors, an investigation revealed that as many as 37.6 million customer records may have been accessed and stolen. The compromised data includes names, membership numbers, email addresses, phone numbers, birth dates, and other personal details for individual customers, as well as corporate clients’ company names, department names, and designated contacts.
The breach appears to have stemmed from vulnerabilities related to Nitori Net and transactions through official stores on third-party e-commerce platforms. Importantly, the company confirmed that passwords and credit card information were not compromised. Efforts to identify the perpetrators, understand the scope, and determine if ransom demands or secondary attacks are underway are ongoing.
Why it matters
Nitori Holdings is a cornerstone of Japan’s retail sector with over 1,000 stores domestically and an international presence, boasting more than 25 million registered app users. This breach not only impacts millions of customers but also threatens the company’s reputation and customer trust amid heightened cybersecurity risks in the country’s retail industry.
The exposed data enables threat actors to pursue phishing, impersonation scams, and other fraudulent activities targeting both consumers and businesses. Amid a recent surge of cyberattacks on major Japanese companies, Nitori’s breach underscores the urgent need for enhanced cybersecurity measures in large retail and e-commerce operations to protect sensitive personal information.
What to watch next
Monitoring for phishing campaigns or fraudulent communications impersonating Nitori or related services will be critical for affected customers and partners. The company advises vigilance against suspicious emails or calls, emphasizing not to open unfamiliar links or attachments. Regulators and industry observers will be looking for details from Nitori’s ongoing forensic analysis regarding the exact intrusion methods and long-term impacts.
Additionally, Japan’s broader cybersecurity posture within retail and consumer sectors will face scrutiny as businesses assess their defenses. With other recent breaches at Iris Ohyama, GMO, and Capcom, Nitori’s incident may drive regulatory and operational changes aimed at preventing similar large-scale breaches and reducing systemic risks.