"On November 6, 2026, we confirmed unauthorized access by a third party to a system managed by our company," the company said in a notification.
Nitori confirms unauthorized access and the size of the leak
Nitori, a major Japanese furniture and home accessories retailer often called the "IKEA of Japan," disclosed that an attacker accessed a system on its network and may have exfiltrated as many as 37.62 million customer records. The intrusion was detected on November 6, 2026, but the company’s investigation found the attacker likely had access to the affected system since mid-October.
Scale, revenue and geographic footprint tied to the incident
The company operates 879 stores in Japan and an additional 219 stores across China, South Korea, Taiwan, Thailand, Singapore and Hong Kong, and reports annual revenue of $5.8 billion. Nitori said the incident impacts individual customers, corporate members, and non-members who placed orders through official Nitori stores and online shops.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTypes of personal information that may have been exposed
Nitori listed the categories of data that may have been leaked. For individual members and purchasers, potentially exposed fields include membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth and gender. For corporate members the company named membership numbers, company names, department names, representatives’ names, company addresses and telephone numbers, and contact persons’ names, email addresses and telephone numbers. Order information for purchases made through Nitori Net and official Nitori shops on e-commerce marketplaces may also have been included.
The company explicitly stated that account passwords of registered members and credit card information were not exposed in this incident.
Containment, remediation and customer warnings
Nitori said it promptly blocked the attacker’s access once the intrusion was detected, addressed vulnerabilities in its systems and strengthened threat monitoring to help prevent similar incidents. The company warned potentially impacted customers that the compromised information could be leveraged in phishing attacks and scamming attempts and urged caution.
The announcement further emphasized that Nitori will never ask customers for their password, credit card number or PIN by email or in phone conversations.
What this means for customers, Japan’s data regulator and security teams
- Customers and corporate members: Nitori has promised to notify affected customers directly by email or post. Given the categories of exposed data the company disclosed, Nitori warned recipients to be alert for phishing and other social-engineering attempts that could use names, addresses, emails or order details to appear legitimate.
- Japan’s Personal Information Protection Commission and law enforcement: Nitori reported the incident to Japan’s Personal Information Protection Commission, the police and other relevant authorities, initiating regulatory and investigative follow-up tied to the large number of records involved.
- Security and IT teams: The company’s stated remediation steps — blocking access, addressing vulnerabilities and strengthening monitoring — will be the immediate operational priorities to contain fallout and reduce the risk of repeat intrusions into systems holding customer data.
Notification, media follow-up and what remains immediate
Nitori said it will notify affected customers directly by email or post. BleepingComputer, which published the disclosure, said it has contacted Nitori with questions and will update its coverage when the company replies. The company’s public notice and the specific lists of data types are the principal facts available from the disclosure; the firm highlighted both the scale of the possible exposure and the limits of the compromise — namely that passwords and credit card details were not taken.
The breach leaves two immediate, concrete steps on the table: Nitori’s direct customer notifications and the follow-up from Japan’s Personal Information Protection Commission and the police — actions the company has already initiated and that will determine how regulators and affected parties respond to a large-scale personal-data exposure.
