Japanese furniture giant Nitori says hackers stole 37.6M customer records

Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records.

The intrusion was detected on November 6, and the company blocked the unauthorized access. However, an investigation into the incident revealed that the attacker likely had access to the system since mid-October.

Nitori, often called the “IKEA of Japan,” is a major furniture and home furnishings retailer that operates 879 stores in Japan and another 219 stores across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong. The firm has an annual revenue of $5.8 billion.

According to the company's notification, the incident impacts individual customers, corporate members, and non-members who placed orders through official Nitori stores and online shops.

“On November 6, 2026, we confirmed unauthorized access by a third party to a system managed by our company,” [machine translated] the company says in the notification 

“Our investigation to date has revealed that up to 37.62 million records of personal information held on our servers may have been leaked externally.”

The potentially exposed information may include the following data types:

• Individual members and purchasers: Membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth, and gender.
• Corporate members: Membership numbers, company names, department names, representatives’ names, company addresses and telephone numbers, and contact persons’ names, email addresses, and telephone numbers.
• Online orders: Order information for purchases through Nitori Net and official Nitori shops on e-commerce marketplaces.

The company specified that account passwords of registered members and credit card information were not exposed in this incident.

Nitori says it promptly blocked the attacker’s access, addressed vulnerabilities in its systems, and strengthened threat monitoring to prevent similar incidents in the future.

The company warned potentially impacted customers that the compromised information could be leveraged in phishing attacks and scamming attempts against, and urged them to exercise caution.

The announcement emphasizes that Nitori will never ask customers for their password, credit card number, or PIN by email or in phone conversations.

Nitori has informed Japan’s Personal Information Protection Commission, the police, and other relevant authorities, and has promised to notify affected customers directly by email or post.

BleepingComputer has contacted Nitori with questions about the incident, and we will update this post when we get a reply.