Nitori Holdings, Japan's largest furniture retailer, said up to 37.6 million customer records may have been stolen in a cyberattack. Customers should treat any message claiming to come from Nitori, a delivery service or an online marketplace with suspicion.
The company said it spotted unauthorized access on November 6, 2026, removed the intruder and began an investigation. The exposed data includes first and last names, membership numbers, email and postal addresses, phone numbers, gender and birth dates. Corporate members also had company and department names, representative names and designated contact persons exposed. The mix varies by customer, the company said, and most of the data likely came from Nitori Net and its official stores on third-party e-commerce marketplaces.
Credit card details and login credentials were not exposed, according to the company. It said it fixed the vulnerabilities used to get in and improved its monitoring, but it is still working with outside specialists on the cause, the method, the extent and any secondary damage. Nitori does not say who is responsible or whether anyone has demanded payment.
The scale is large even by retail standards. Nitori runs more than 1,000 stores and operates in 11 overseas markets. It reported $6.1 billion in revenue and almost 93 million customer purchases. The 37.6 million figure is a count of records, not people, and it exceeds the 25 million registered members in its mobile apps. That fits the company's own pointer to marketplace storefronts, where shoppers never touch Nitori's app.
The breach follows a string of Japanese incidents. Iris Ohyama confirmed losing data on 7.7 million people through its Iris Plaza site, and Capcom reported losing information on more than 11.7 million. GMO told customers to unplug devices after a ransomware threat. No group has claimed any of them. That is unusual, since criminals typically press victims for payment, and leaks invite class-action suits and regulator attention. Nothing in the disclosures links the cases, but the silence is the part worth watching.