Breach · 3 min read
Nitori: personal details of up to about 37.62 million customers may have been taken
Nitori Holdings says unauthorized access may have reached about 37.62 million member and buyer records. Cards and passwords were not in the set, the company says.
Nitori Holdings, the Japanese home-furnishings retailer behind Nitori and Nitori.net, says personal information belonging to up to about 37.62 million people may have left systems it manages after unauthorized access found on November 6, 2026. The company published a notice on November 9. Credit card numbers and login passwords were not in the set that may have been reached, it says.
What happened
According to Nitori Holdings’ November 9 notice (PDF, in Japanese), staff confirmed unauthorized access to a company-managed system on November 6. The firm blocked that access the same day and began working with outside specialists. Later log review showed earlier third-party access may have begun in mid to late October. Attackers are blocked now. Counts and scope may change as matching continues.
What may have been exposed
As of the November 9 notice, up to about 37.62 million records may have been reached. Combinations vary by person:
- Individual members and people who bought from the Nitori group: membership number, name (including furigana), email address, postal address, phone number, date of birth and gender.
- Corporate members: membership number, company name, department, representative’s name, company address and phone, plus the contact person’s name, email and phone.
- Orders through Nitori.net and Nitori’s official shops on other EC malls are in scope for the order data the company holds.
The company says credit card details and login passwords are not in the data that may have left. It is notifying Japan’s Personal Information Protection Commission and police, and says it will contact affected people by email or post.
What this means for you
A name, address, phone and email are enough for a convincing “Nitori delivery,” refund or account message. Cards should be unaffected according to the company, but a phishing call does not need a card number. Reused passwords elsewhere are still worth changing if you ever used the same one on Nitori.net.
What you can do
- Watch for Nitori’s individual notice by email or mail. The company says it will never ask for a password, card number or PIN by email or phone.
- Treat unexpected Nitori, delivery or mall messages as suspect, even if they use your real name or order details. Type URLs yourself. Do not open attachments or tap links in cold messages.
- Call Nitori’s customer desk at 0120-209-993 (daily, 10:00 a.m. to 8:00 p.m. local time) or use the inquiry form if you have questions.
- See how scammers use leaked data to make phishing personal if a message already seems to know your details.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each shop its own address, so a fake store message that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.
Related coverage
- Iris Plaza: personal details of up to about 7.7 million shoppers may have been taken: another large Japanese retail disclosure this week.
- MUJI now says full card numbers of about 1.09 million MUJI Card holders may have been reached: a related Japanese retail story from this month.
- How scammers use leaked data to make phishing personal.
Sources
- Nitori Holdings, Apology and notice: possible personal data leak after unauthorized access to our systems (PDF, in Japanese), November 9, 2026
- ITmedia NEWS, Unauthorized access at Nitori; up to about 37.62 million personal records may have left (in Japanese), November 9, 2026
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.