Nitori Says Up to 37.62 Million Customer Records May Have Leaked. That Is Records, Not People. Names, Addresses, Phone Numbers and Birth Dates; No Passwords or Cards, Per Nitori
If you have ever ordered from Nitori, through Nitori Net or a Nitori official shop on a shopping mall site, or hold a Nitori personal or business membership, expect phishing that uses your real name, address, phone number and birth date. Nitori says it will never ask for your password, card number or PIN by email or phone. Do not click links in messages that claim to be from Nitori, a delivery company or a shopping mall; go to Nitori's site yourself.
What Nitori says
The primary source is Nitori Holdings' notice to customers dated Monday, November 9, 2026, published in Japanese on nitorihd.co.jp. We read the Japanese original. The quotes below are our own translation.
- "On November 6, 2026, we confirmed unauthorized access by a third party to a system managed by our company." That was a Friday. Nitori says it cut off the access and began an investigation with outside specialists.
- "Up to 37.62 million records of personal information held on our servers may have been leaked externally." Nitori's word is "件", which counts records, not people. Nitori has not said how many distinct customers that is, and told BleepingComputer on November 11 that it has not yet determined the number. One person who is both a member and a past buyer could appear more than once. The notice also says the count may change as log analysis continues.
- Log analysis after November 6 showed a third party "may have had access" from mid to late October, before the intrusion was found.
- "Login passwords and credit card information are not included in the information that may have leaked."
- Nitori says it fixed the weak points it found, strengthened monitoring, and reported the incident to Japan's Personal Information Protection Commission and the police. It will contact affected customers by email or post.
Nitori's notice says "may have leaked," not "was stolen." Some headlines say "stole." The notice does not say how the attacker got in, does not name an attacker and does not mention ransomware. On November 11 a Nitori spokesperson told BleepingComputer the company is still investigating the cause, "including whether ransomware was involved."
What data, by customer type
From the notice, our translation. Nitori says the combination differs from customer to customer.
- Personal members and anyone who bought from the Nitori group: membership number, name (including the phonetic reading), email address, postal address, phone number, date of birth and gender.
- Business members: membership number, company name, department, representative's name, company address and phone number, and the contact person's name, email address and phone number.
- Orders: order data for Nitori products ordered through Nitori Net and through Nitori official shops on online shopping malls.
What to do
- Expect convincing phishing. A message that knows your name, address and birth date is not proof it comes from Nitori. Nitori's own warning names fake messages posing as Nitori, delivery companies and shopping malls.
- Do not reply to the contact details in a suspicious message. Nitori asks customers to use the contact desk listed on its official website instead.
- Do not give out a password, card number or PIN to anyone who asks by phone or email in Nitori's name.
- Treat your birth date and address as known to strangers. If a bank, phone carrier or other service uses either as a security question, ask for a stronger check.
- Business members: warn the named contact person in your company. Messages with real order history are a common route to invoice and payment-change fraud.
- Passwords were not exposed, per Nitori. If you reused your Nitori password elsewhere, changing it is still cheap insurance until the investigation ends.
What is not known
How the attacker got in, who it was, whether data has been published or offered for sale, whether ransomware was involved, and how many people the 37.62 million records cover. Nitori says it will publish new findings.
How we know, and how we checked
We downloaded Nitori's PDF notice from nitorihd.co.jp and read the Japanese text; the translations are ours. We also read BleepingComputer's report, which adds the spokesperson's November 11 comment. No source published any IP addresses, domains or file hashes, so we add nothing to our feed for this incident. We found no prior coverage of this incident in our research archive.
Sources
Nitori Holdings, notice to customers on unauthorized access and possible leak of personal information, November 9, 2026 (Japanese PDF, nitorihd.co.jp). BleepingComputer, "Japanese furniture giant Nitori says hackers stole 37.6M customer records," November 10, 2026, updated November 11.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.