Overview

Japanese furniture and home accessories retailer Nitori Holdings has disclosed a major data breach in which attackers gained unauthorized access to its systems, potentially exposing up to 37.62 million customer records.

The company detected the unauthorized activity on November 6, 2026, and subsequently blocked the attacker's access. However, an investigation revealed that the intrusion may have started as early as mid-October, indicating that the attackers could have maintained access to the company's systems for several weeks before detection.

The potentially exposed information includes customer names, email addresses, residential addresses, telephone numbers, dates of birth, gender, membership details, and online purchase information. Corporate membership records may also have been affected.

Although the incident involves a substantial amount of personal information, Nitori confirmed that customer login passwords and credit card details were not included in the potentially exposed data. The company is continuing its investigation with external cybersecurity specialists to determine the cause, entry point, and full extent of the incident.

Key Facts of the Incident

Note: The reported figure represents potentially exposed records, not a confirmed count of unique affected individuals. The investigation is ongoing, and the final impact assessment may change.

What Happened?

Nitori Holdings identified unauthorized access to a company-managed system on November 6, 2026. Following the discovery, the company immediately blocked the unauthorized access and began investigating the incident with external cybersecurity specialists.

An examination of system logs indicated that the unauthorized activity may have occurred before November 6, potentially beginning between mid-October and late October 2026.

The investigation revealed that personal information stored on the company's servers may have been accessed and transferred outside its systems. The estimated number of potentially exposed records stands at approximately 37.62 million.

The incident affects multiple categories of customer information, including individual membership records, corporate membership details, and purchase information associated with Nitori's online shopping services.

The company has not yet disclosed the specific vulnerability or intrusion method used by the attackers. It is also investigating the exact scope of the incident and whether any additional damage occurred.

In an update on November 11, the company indicated that it was still investigating the cause of the incident, including whether ransomware was involved, with assistance from external cybersecurity experts. Ransomware involvement has not been established.

What Information May Have Been Exposed?

The incident potentially affects personal and corporate information maintained across Nitori's customer and e-commerce systems.

The categories of information identified by the company include:

1. Individual Customer Information

Personal information belonging to individual members and customers who purchased products through Nitori's services may have been exposed.

Potentially affected information includes:

• Membership numbers

• Full names

• Email addresses

• Residential addresses

• Telephone numbers

• Dates of birth

• Gender

2. Corporate Membership Information

Corporate accounts associated with Nitori's business services may also have been affected.

The information potentially exposed includes:

• Membership numbers

• Company names

• Department names

• Names of company representatives

• Business addresses and telephone numbers

• Contact persons' names

• Business email addresses and phone numbers

3. Online Purchase Information

Customer order information associated with Nitori Net and the company's official stores on e-commerce marketplaces was also included in the potentially exposed dataset.

The exact combination of information varies between customers and records.

4. Information Not Affected

Nitori specifically stated that the incident did not involve the exposure of registered members' login passwords or credit card information.

While this reduces the immediate risk of direct payment-card misuse and password-based account compromise from these records, the exposed personal information could still be exploited for targeted scams and identity-related fraud.

Immediate Impact & Risks

The potential exposure of tens of millions of customer records creates several security risks, particularly involving targeted social engineering attacks.

Some of the major concerns include:

- Targeted Phishing Campaigns: Attackers could use exposed names, email addresses, and other personal information to create convincing phishing emails that appear to originate from Nitori or its associated services.

- Delivery and Order Scams: Exposed purchase information could help criminals impersonate delivery companies, e-commerce platforms, or customer support representatives to deceive customers into clicking malicious links.

- Identity-Based Social Engineering: Information such as dates of birth, residential addresses, and telephone numbers can make fraudulent communications appear more legitimate and personalized.

- Fraudulent Phone Calls: Attackers could impersonate company representatives or service providers and use genuine customer information to establish trust before requesting sensitive details.

- Increased Risk of Follow-Up Attacks: The compromised information could be reused in future phishing, impersonation, and other social engineering campaigns targeting affected customers.

Nitori has already warned customers about the possibility of phishing emails, spoofed communications, and suspicious phone calls involving the potentially exposed information.

What Nitori Is Doing?

Following the discovery of unauthorized access, Nitori has initiated several incident response and security measures.

The company's response includes:

1. Blocking Unauthorized Access

Nitori stated that it immediately restricted the attacker's access after discovering the intrusion and continues to maintain these restrictions.

2. Addressing Security Vulnerabilities

The company has implemented measures to address identified vulnerabilities and strengthen its security monitoring infrastructure.

3. External Cybersecurity Investigation

Nitori is working with external cybersecurity specialists to investigate the incident, including its root cause, initial intrusion method, affected systems, and potential secondary damage.

4. Customer Notifications

The company plans to contact affected customers through email or postal communication as the investigation progresses.

5. Reporting to Authorities

Nitori has initiated reporting and consultation with Japan's Personal Information Protection Commission, police, and other relevant authorities.

The company has also stated that it will review access controls, authentication mechanisms, permission management, and monitoring systems to prevent similar incidents in the future.

What Organizations Should Do

The Nitori incident highlights the importance of protecting customer information and maintaining effective security monitoring across digital platforms.

Organizations handling large volumes of personal and customer data should consider the following security measures:

1. Strengthen Access Controls

Implement strict access management policies, multi-factor authentication, least-privilege permissions, and regular access reviews to reduce the possibility of unauthorized system access.

2. Monitor Systems for Suspicious Activity

Organizations should continuously monitor network traffic, authentication logs, server activity, and unusual data transfers to identify potential intrusions before significant information is exposed.

3. Secure Customer Information

Minimize unnecessary data collection and retention. Apply encryption, appropriate access restrictions, and security controls to databases containing personal and corporate information.

4. Prepare for Secondary Phishing Attacks

A data breach does not end when unauthorized access is blocked. Organizations should anticipate follow-up phishing and impersonation campaigns that exploit exposed customer information.

Employees and customers should be trained to identify suspicious emails, unexpected requests, fraudulent phone calls, and messages impersonating trusted organizations.

5. Strengthen Cybersecurity Awareness

Regular cybersecurity awareness training and realistic phishing simulations can help employees recognize social engineering attempts and respond appropriately.

Organizations should also assess why employees fall for particular phishing attempts rather than relying exclusively on click rates. Understanding the psychological and emotional triggers behind these decisions can help security teams develop more effective awareness strategies.

Why This Matters?

The Nitori data breach demonstrates how unauthorized access to a single company's systems can potentially expose information associated with millions of customers.

Although passwords and credit card details were not included in the potentially compromised data, personal information such as names, addresses, phone numbers, and purchase records can provide attackers with valuable material for highly personalized social engineering campaigns.

The incident also highlights a broader cybersecurity challenge: preventing unauthorized access is only one part of data protection. Organizations must also be capable of detecting suspicious activity quickly, limiting the amount of information accessible to attackers, and preparing users to recognize fraudulent communications that may follow a breach.

For businesses operating large customer databases, continuous security monitoring, effective access management, and human-centered cybersecurity awareness are essential to reducing the risks associated with modern cyberattacks.

Disclaimer: ClearPhish maintains a strict policy of not participating in the theft, distribution, or handling of stolen data or files. The platform does not engage in exfiltration, downloading, hosting, or reposting any illegally obtained information. Any responsibility or legal inquiries regarding the data should be directed solely at the responsible cybercriminals or attackers, as ClearPhish is not involved in these activities.