Nitori Discloses Data Breach Affecting 37.6 Million Customer Records

Japanese furniture and home accessories giant Nitori has disclosed a significant data breach, revealing that an attacker gained unauthorised access to a system on its network and may have stolen up to 37.6 million customer records.

The company, often referred to as the “IKEA of Japan,” detected the intrusion on 6 November 2026. While access was promptly blocked, Nitori’s investigation indicates the attacker may have had access to the system since mid-October. Nitori operates 879 stores in Japan and an additional 219 internationally across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong, with annual revenues of $5.8 billion.

Customer Data Potentially Exposed

According to Nitori’s notification, the breach potentially impacts individual customers, corporate members, and non-members who made purchases through official Nitori stores and online platforms. The types of personal information that may have been exposed include:

• Individual members and purchasers: Membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth, and gender.
• Corporate members: Membership numbers, company names, department names, representatives’ names, company addresses and telephone numbers, and contact persons’ names, email addresses, and telephone numbers.
• Online orders: Specific order information for purchases made via Nitori Net and official Nitori shops on e-commerce marketplaces.

Nitori confirmed that customer account passwords and credit card information were not compromised in this incident.

Company Response and Customer Guidance

Following the discovery, Nitori immediately blocked the unauthorised access, addressed identified system vulnerabilities, and enhanced its threat monitoring capabilities to prevent future incidents. The company has informed Japan’s Personal Information Protection Commission, the police, and other relevant authorities. It has also committed to directly notifying all affected customers via email or post.

Nitori has urged potentially impacted customers to remain vigilant against phishing attacks and scamming attempts, cautioning that the stolen information could be used for such malicious purposes. The retailer stressed that it would never ask customers for passwords, credit card numbers, or PINs via email or phone.