Nitori Data Breach May Expose Up to 37.62 Million Records
Japanese home furnishings retailer Nitori Holdings has warned that a data breach may have exposed up to 37.62 million records after an unauthorised party accessed systems managed by the company. The incident could affect personal and corporate membership information, purchase records and online orders.
Nitori disclosed the incident on November 9, following the discovery of unauthorised access on November 6. Its investigation indicates that the activity may have started earlier, between mid-October and late October. The company has not yet confirmed the final number of affected records or the full extent of the exposure.
Nitori data breach could affect several types of information
The potentially exposed information includes membership numbers, names, email addresses, home addresses, telephone numbers, dates of birth and gender details. The company also identified information linked to corporate members, including business names, department details, representative names, company contact information and employee contact details.
The investigation also covers order information connected to Nitori's online shopping service and its official stores on e-commerce marketplaces. The combination of information involved may differ between individuals.
Nitori has specifically stated that credit card information and website login passwords are not included in the potentially exposed data. The company has not presented the 37.62 million figure as a confirmed count of unique customers. It is the maximum number of records that may have been affected, and further analysis could change the estimate.
Company blocks access and investigates the incident
Nitori said it blocked the unauthorised access after identifying the incident on November 6. It has also addressed identified vulnerabilities and strengthened its monitoring arrangements.
External specialists are assisting with the investigation. The company is examining the cause, possible entry points, the extent of the exposure and whether any secondary damage has occurred. It is also reporting the incident to Japan's Personal Information Protection Commission and consulting with police and other relevant authorities.
Nitori plans to contact affected customers by email or postal mail as the investigation progresses. It has not yet disclosed a confirmed cause or identified the party responsible for the intrusion.
Nitori warns customers about phishing attempts
The potential exposure of names, addresses, phone numbers and other identifying details creates a risk beyond the initial system intrusion. Criminals could use such information to make fraudulent messages or calls appear more convincing.
Nitori has warned customers to watch for emails, telephone calls and other communications impersonating the retailer, delivery companies or e-commerce marketplaces. It has also advised users not to open unfamiliar links or attachments.
The company says it will not ask customers for passwords, credit card numbers or PINs through email or telephone calls. Anyone receiving suspicious communication should avoid replying through the contact details provided in that message and instead use the company's official website.
Why the Nitori data breach matters
The Nitori data breach highlights how a large retailer's customer and business records can create a significant security risk when unauthorised access occurs. Even when payment information and passwords are not involved, exposed contact and identity details can support targeted phishing and impersonation attempts.
The final impact remains unclear. Nitori is continuing its investigation and says it will disclose further information if new findings emerge. Until the company confirms the affected records and any evidence of misuse, the 37.62 million figure should be treated as a potential exposure estimate rather than a verified count of stolen customer accounts.
