---
title: Nitori, Japan's largest furniture retailer, says intruders may have taken up to 37.62 million customer records | ctxsec
url: https://ctxsec.com/items/nitori-unauthorized-access-up-to-37-62m-customer-records-nov-9
description: "Nitori Holdings says it found unauthorized third-party access to a system it manages on Nov 6, cut it off, and has since found signs the attacker was also in the system from mid- to late October. Up to 37.62 million personal-information records held on its servers may have been leaked. Login passwords and credit card data are not affected, it says. The entry route and cause are still under investigation, and it has reported the incident to Japan's Personal Information Protection Commission and police."
status: "official (Nitori Holdings notice, Nov 9, 2026); counts are records, not people, and may change as the investigation continues"
published: 2026-11-10
---

> Nitori Holdings says it found unauthorized third-party access to a system it manages on Nov 6, cut it off, and has since found signs the attacker was also in the system from mid- to late October. Up to 37.62 million personal-information records held on its servers may have been leaked. Login passwords and credit card data are not affected, it says. The entry route and cause are still under investigation, and it has reported the incident to Japan's Personal Information Protection Commission and police.

[← Cybersecurity News](/news) · [markdown](/items/nitori-unauthorized-access-up-to-37-62m-customer-records-nov-9.md)

official (Nitori Holdings notice, Nov 9, 2026); counts are records, not people, and may change as the investigation continues

2026-11-10

### Nitori, Japan's largest furniture retailer, says intruders may have taken up to 37.62 million customer records

- **Data that may be exposed:** individual members and purchasers (member number, name with reading, email, address, phone, date of birth, gender); corporate members (company name, department, representative, company address and phone, contact person's name, email and phone); and order data from Nitori Net and Nitori's official shops on e-commerce marketplaces. The combination differs per customer.
- **What Nitori did:** blocked the access, says it fixed the weak point and strengthened monitoring, and is working with outside specialists. Affected customers will be contacted by email or post.
- **Phishing risk:** Nitori warns that the data could be used for impersonation emails and calls posing as Nitori, delivery companies or marketplaces, and says it never asks for passwords, card numbers or PINs by email or phone.

Sources: [Nitori Holdings: notice of possible personal data leak from unauthorized system access (Japanese PDF, Nov 9, 2026)](https://www.nitorihd.co.jp/news/items/2b702dbe4d438f7fef74945d68e5bd27.pdf) · [BleepingComputer: Japanese furniture giant Nitori says hackers stole 37.6M customer records (Nov 10, 2026)](https://www.bleepingcomputer.com/news/security/japanese-furniture-giant-nitori-says-hackers-stole-376m-customer-records/) · [Nikkei: Nitori HD, up to 37.62 million customer records may have leaked (Nov 9, 2026)](https://www.nikkei.com/article/DGXZQOUC097MY0Z01C26A1000000/)