Security notice
Run an online store? Nitori says up to 37.62 million customer records may have leaked, and the intruder may have been in for weeks.
On November 9, 2026, Nitori Holdings, the Japanese furniture and home goods retailer, said it confirmed unauthorized access by a third party to a system it manages on November 6, and that up to 37.62 million records of personal information held on its servers may have leaked. The records cover individual and corporate members, buyers, and order data from its Nitori Net online store and its official shops on online marketplaces. Nitori says login passwords and credit card information were not included. Its log analysis found the intruder may have had access from mid-to-late October, before it was found. Nitori has not said how the intruder got in. This is not a software flaw, so there is nothing to patch and no CVE. If you shopped with Nitori, expect phishing. If you run a store, ask how quickly you would notice someone quietly reading your customer data. (Nitori notice)
What happened
- Found on November 6. Nitori says it confirmed unauthorized access by a third party to a system it manages on November 6, blocked the access right away and began investigating with outside specialists. (Nitori notice)
- Earlier access likely. Nitori says log analysis after November 6 found that a third party may have had access from mid-to-late October. It says the details are still under investigation. (Nitori notice)
- Up to 37.62 million records. Nitori says up to 37.62 million records of personal information held on its servers may have leaked, and that the scope and count may change as log analysis continues. (Nitori notice)
- What Nitori has done. It says it continues to block the attacker, has dealt with the weak points and has finished strengthening its monitoring. It says it will review access control, authentication and permission management, and monitoring. It is reporting to Japan's Personal Information Protection Commission and the police. (Nitori notice)
- Cause not yet known. Nitori has not said how the intruder got in. A Nitori spokesperson told BleepingComputer on November 11 that it is investigating the cause, including whether ransomware was involved, and has not yet determined how many customers are affected. (BleepingComputer)
What data
Nitori says the combination of data differs from customer to customer. (Nitori notice)
- Individual members and buyers: member number, name, email address, postal address, phone number, birth date and gender.
- Corporate members: member number, company name, department, representative's name, company address and phone number, and the contact person's name, email address and phone number.
- Orders: order data for Nitori products bought through Nitori Net and Nitori's official shops on online marketplaces.
- Not included: login passwords and credit card information, Nitori says.
Who should worry
- You shopped with Nitori in Japan, in stores, on Nitori Net or at its official marketplace shops, or you are a Nitori corporate member.
- You run an online store that keeps customer names, addresses and order history on your own servers or a system you manage.
- You are not sure who in your business, or at your developer or agency, can reach your customer database.
If you never shopped with Nitori and your site keeps no customer data, this notice does not apply to you.
What to do now
If you are a Nitori customer. This follows Nitori's advice.
- Expect phishing. Nitori warns the data could be used in fake emails, phishing and suspicious phone calls, including messages pretending to be Nitori, delivery companies or online marketplaces. Do not open links or attachments you do not recognize. (Nitori notice)
- Never give your password, card number or PIN. Nitori says it will never ask for them by email or phone. If you get a suspicious contact, use the contact details on Nitori's official site, not the ones in the message. (Nitori notice)
- Watch for Nitori's message. It says it will contact affected customers by email or post. (Nitori notice)
If you run an online store. Nitori has not said how the intruder got in, so we cannot say which of these would have helped. These are general steps, not from Nitori, and we are not claiming any tool, including EverThread, would have prevented or caught this.
- List who can reach your customer data. That includes store admin accounts, database logins, hosting accounts and any outside developers or apps. Remove what is no longer needed.
- Turn on two-step sign-in for every admin, hosting and database account that offers it.
- Keep access logs and read them. Ask your host or developer whether logins and large data exports are logged, how long the logs are kept, and whether anything alerts you. Nitori says it found signs of possible access from mid-to-late October, before it noticed on November 6.
- Keep software up to date and remove plugins, apps and old systems you no longer use.
- Warn your own customers if you are ever breached. Tell them you will never ask for passwords or card numbers, as Nitori did.
What to send your developer, agency or host
Nitori Holdings said on November 9, 2026 that an intruder reached one of its systems and that up to 37.62 million customer records, including online order data, may have leaked, with signs of access from mid-to-late October before it was found on November 6. Nitori has not said how the intruder got in. Please send us a list of every account and app that can reach our store's customer data, including admin, hosting and database logins, and remove any that are no longer needed. Please confirm that two-step sign-in is on wherever it is offered, tell us whether logins and data exports are logged, how long logs are kept and whether anything alerts us, and confirm that our store software, plugins and apps are up to date. Sources: Nitori Holdings notice of November 9, 2026; BleepingComputer.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It is about a breach at Nitori. It matters to you as a shopper if you bought from Nitori, and as a store owner because the data involved is the kind most online stores keep.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see your admin accounts, your servers or your customer database, and we cannot tell you whether you were one of Nitori's customers.
Were passwords or card numbers taken?
Nitori says login passwords and credit card information were not among the data that may have leaked. (Nitori notice)
Was it ransomware?
Nitori has not said. Its spokesperson told BleepingComputer it is investigating the cause, including whether ransomware was involved. (BleepingComputer)
Where can I follow official updates?
Nitori Holdings' official site (in Japanese). All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Nitori Holdings: Apology and notice about possible personal information leak due to unauthorized access to our system, November 9, 2026 (PDF), in Japanese, checked November 11, 2026
- BleepingComputer: Japanese furniture giant Nitori says hackers stole 37.6M customer records, November 10, 2026, updated November 11, 2026, checked November 11, 2026