Nitori breach: 37.62 million customer records may have leaked

Attackers may have stolen 37.62 million customer records from Nitori, the Japanese furniture and home accessories giant often called the "IKEA of Japan." The company confirmed the intrusion on November 6 and blocked the unauthorized access — but its investigation found the attacker had likely been inside the network since mid-October.

That's a dwell time measured in weeks, not days. And the scale is hard to overstate: Nitori operates 879 stores in Japan plus another 219 across China, South Korea, Taiwan, Thailand, Singapore and Hong Kong, and pulls in $5.8 billion in annual revenue. The breach touches individual customers, corporate members and even non-members who placed orders through official Nitori stores and online shops.

"On November 6, 2026, we confirmed unauthorized access by a third party to a system managed by our company," the company said in its notification. "Our investigation to date has revealed that up to 37.62 million records of personal information held on our servers may have been leaked externally."

What data was exposed?

The potentially leaked information varies by customer type:

• Individual members and purchasers: membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth and gender.
• Corporate members: membership numbers, company names, department names, representatives' names, company addresses and telephone numbers, plus contact persons' names, email addresses and telephone numbers.
• Online orders: order information for purchases through Nitori Net and official Nitori shops on e-commerce marketplaces.

There is one significant piece of good news. Nitori specified that account passwords of registered members and credit card information were not exposed in the incident. Payment data and credentials stayed out of the attacker's hands, even as 37.62 million contact records potentially walked out the door.

What does this change for affected customers?

The practical risk is downstream fraud. Nitori warned that the compromised information could be leveraged in phishing attacks and scam attempts, and urged customers to exercise caution. The announcement emphasizes that Nitori will never ask customers for a password, credit card number or PIN by email or over the phone — a line worth remembering for anyone who has shopped at the retailer.

For corporate members, the exposure is arguably sharper: company names, department structures and named contact persons with direct phone numbers and email addresses are exactly the raw material used to craft convincing business email compromise campaigns.

How did Nitori respond?

The company says it acted on three fronts:

• Promptly blocked the attacker's access
• Addressed vulnerabilities in its systems
• Strengthened threat monitoring to prevent similar incidents

Nitori has also informed Japan's Personal Information Protection Commission, the police and other relevant authorities, and has promised to notify affected customers directly by email or post.

BleepingComputer contacted Nitori with questions about the incident and will update its coverage when the company replies. Nitori has not yet named the affected system, described the vulnerabilities that were patched, or said whether it has identified the attacker.

For a retailer of this scale, the arithmetic is sobering: 37.62 million records against a national population of roughly 125 million means the breach plausibly touches a meaningful share of Japan's households. The follow-through to watch now is the direct notification campaign — and whether regulators push for more detail on how three weeks of undetected access was possible.