Japan's largest furniture chain, Nitori Holdings, has disclosed a significant cyberattack that may have exposed up to 37.6 million customer records. The unauthorized access was first detected by the company on November 6, 2026. After identifying the intrusion, the company ousted the attacker, plugged the security flaws, and launched a comprehensive investigation into the breach.
The compromised information includes a wide range of personal details, though Nitori confirmed that payment data and login passwords remained secure. According to the company, the leaked records potentially feature first and last names, membership numbers, email addresses, postal addresses, phone numbers, gender information, and birth dates. Corporate members also faced exposure of their company and department names, alongside names of representatives, phone numbers, and designated contact persons. The specific data combination varies per customer and largely stems from Nitori Net and official stores operating on third-party e-commerce marketplaces.
Key takeaways
- Nitori Holdings discovered unauthorized system access on November 6, 2026.
- Up to 37.6 million customer records may have been exfiltrated in the attack.
- Passwords and credit card information were confirmed safe and unaffected.
- The company has partnered with external specialists to investigate the method of intrusion.
Remediation efforts and ongoing investigation
Nitori stated that it has already addressed the vulnerabilities exploited during the breach and completed improvements to its monitoring systems. External cybersecurity specialists are actively working alongside the home furnishing retailer to determine the root cause, exact method of intrusion, and the full extent of the impact. At this stage, crucial details regarding the threat actors remain unknown, and there is no public indication of whether attackers have made extortion demands.
The retailer, frequently compared to IKEA, operates over 1,000 stores across Japan and 11 overseas markets including China, Taiwan, South Korea, and a handful of Southeast Asian countries. Last year, the corporation reported $6.1 billion in revenue, employing more than 41,000 people and serving close to 93 million customer purchases. Its mobile applications currently boast more than 25 million registered members.
Phishing risks and regional context
Following the disclosure, Nitori warned both its massive customer base and employees to remain vigilant regarding potential secondary threats. The leaked personal data creates significant risks for targeted phishing scams, impersonation emails, and suspicious phone calls. Customers are urged to exercise extreme caution with any communications claiming to originate from Nitori, delivery providers, or e-commerce marketplaces, and to avoid opening unfamiliar links or attachments.
This incident arrives amid a broader wave of high-profile cyberattacks targeting major Japanese corporations. Recent months have seen similar data breaches at consumer goods manufacturer Iris Ohyama, which lost data on 7.7 million people, internet giant GMO, and gaming conglomerate Capcom, which reported losing sensitive information on more than 11.7 million people. Despite the scale of these breaches, no threat actors have claimed public responsibility for these incidents.
Comments