Reported by 2 outlets
The story so far
AI summary of the reporting below · Updated · How we work
Nitori Holdings discovered unauthorized access to its network on November 6, 2026, revealing a breach that may have compromised up to 37.62 million customer records. An internal investigation indicated the intruder likely maintained access to the retailer's systems since mid-October. The incident affects individual consumers, corporate clients, and non-members who purchased goods through Nitori Net or its official storefronts on third-party digital marketplaces. [1][2]
Exfiltrated records include customer names, membership identifiers, email and postal addresses, telephone numbers, birth dates, and gender details. For corporate accounts, exposed data encompasses company and department names alongside contact representative information. Nitori confirmed that user passwords and credit card credentials were not compromised during the attack. The retailer blocked the unauthorized access, patched the exploited vulnerabilities, alerted authorities including Japan's Personal Information Protection Commission, and warned shoppers to watch for phishing emails. [1][2]
The company operates hundreds of stores across Japan and regional markets such as China and South Korea, generating billions in annual sales. Cyber investigators continue working with external specialists to determine if ransomware was deployed, while no threat group has claimed responsibility. The attack follows several major breaches across Japan, including recent intrusions targeting firms such as Iris Ohyama and Capcom. [1][2]
Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records.
via BleepingComputer
The hole was plugged and attackers ousted but the investigation continues.
via TechRadar