Nitori says hackers may have copied up to 37.62 million customer records
Customers should treat unsolicited messages with suspicion, since the leaked details could be used in phishing and scam attempts.
Japanese furniture retailer Nitori says an intruder reached one of its internal systems and may have copied up to 37.62 million customer records. Nitori detected the intrusion on November 6, 2026 and shut off the access, but its investigation indicates the attacker may have been inside since mid-October. The exposed data may include membership numbers, names, contact details, birth dates and gender for individuals, corporate contact details, and order histories from Nitori's own online store and its marketplace shops. Passwords and credit card information were reportedly not affected. Because the leaked details could fuel phishing and scam attempts, Nitori is warning customers to be wary of unsolicited messages and has notified Japan's Personal Information Protection Commission and police, with direct notices to customers promised.
Why it matters
For Nitori's customers, the risk is less about stolen passwords or card numbers, which Nitori says were not exposed, and more about targeted phishing built on personal details such as names, contact information and order histories. Corporate contacts are also affected, so business customers face the same exposure. The intruder may have been inside since mid-October, a longer window than the November 6 detection date suggests, and Nitori has reported the incident to Japan's Personal Information Protection Commission and the police, with direct notices to customers still to come.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.