Japanese furniture and home-goods retailer Nitori says it confirmed unauthorized access by a third party to a system managed by the company on 6 November 2026, and that up to 37.62 million records of personal information held on its servers may have been leaked, according to BleepingComputer (Bill Toulas, 10 Nov 2026), which quotes the company's notification (machine-translated).

According to BleepingComputer, the company blocked the access, and its investigation found the attacker likely had access to the system since mid-October. The incident affects individual customers, corporate members and non-members who ordered through official Nitori stores and online shops. Data that may be exposed: for individual members and purchasers, membership numbers, names, email and postal addresses, phone numbers, dates of birth and gender; for corporate members, membership numbers, company and department names, representatives' names, company addresses and phone numbers, and contact persons' names, emails and phone numbers; and order information for purchases through Nitori Net and official Nitori shops on e-commerce marketplaces.

The company says registered members' account passwords and credit card information were not exposed. Nitori says it addressed vulnerabilities in its systems, strengthened monitoring, informed Japan's Personal Information Protection Commission and the police, and will notify affected customers by email or post; it warns the data could be used in phishing and scams and says it will never ask for passwords, card numbers or PINs by email or phone. (source: BleepingComputer, citing Nitori's notification)