Nitori data breach

What happened

Nitori Holdings, the Japanese furniture and homeware retailer, said on November 9, 2026 that an outsider accessed a system it manages and that up to 37.62 million records of personal data held on its servers may have been taken. It found the intrusion on November 6 and cut it off the same day; log analysis since then shows the attacker may also have been inside from mid-to-late October. The data covers individual members and people who bought from the Nitori group (member number, name with phonetic reading, email address, address, phone number, date of birth and gender), corporate members (company name, department, representative's name, company address and phone, and the contact person's name, email and phone), and order data for purchases through Nitori Net and Nitori's official shops on online marketplaces. Login passwords and credit card data are not included. Nitori says the count may change as its investigation continues and that it is reporting the incident to Japan's Personal Information Protection Commission and police.

What should I do?

1. Be wary of emails, texts and calls claiming to be from Nitori, a delivery company or an online marketplace, and don't open links or attachments you weren't expecting.
2. Nitori says it will never ask for passwords, card numbers or PINs by email or phone; if in doubt, contact Nitori's customer line (0120-209-993) from its official website rather than the details in the message.
3. Expect convincing scams that know your name, address, birthday and past orders, and don't pay or confirm details in reply to them.
4. If you use your Nitori email address and password elsewhere, consider changing those passwords even though Nitori says passwords were not taken.

More data breaches in Japan →

Check the other services you use →