Nitori Says Up to 37.62 Million Customer Records May Have Leaked as Japan Breach Wave Accelerates

Japan's retail sector faced another difficult week on November 9, 2026, when Nitori Holdings Co. disclosed that unauthorized access to a system it manages may have exposed up to 37.62 million customer records. Nitori is a major seller of furniture, interior goods and household products. The case reaches individual members, people who bought goods online, corporate members and order data tied to Nitori Net and the company's shops on online marketplaces.

The scale alone makes the notice one of Japan's most significant security disclosures this year. Japan Cyber Watch, which keeps a running list of major incidents, ranked it as the fourth-largest breach disclosed in the country in 2026. The figure of 37.62 million refers to records rather than a confirmed count of people, and one person may appear in several data sets. Nitori said login passwords and credit card details were not affected, leaving a rich set of personal and commercial information in scope.

Nitori confirmed the unauthorized access on Friday, November 6, 2026, and blocked it. A third-party investigation later found that an intruder may have accessed the system in mid-to-late October, which would mean the intrusion went unnoticed for up to three weeks. Nitori brought in outside specialists, fixed a vulnerable point and strengthened monitoring. It reported the matter to Japan's Personal Information Protection Commission and is consulting police.

The Nitori case is arriving in the middle of a much wider surge in Japanese breach disclosures. Retailers, publishers, insurers and marketing services have all reported incidents in recent weeks, and the government has responded with an emergency package and a nationwide police investigation. The result is a test of how Japan handles a breach wave that keeps getting larger.

Key Facts

The Mainichi reported on November 9, 2026, that Nitori Holdings said up to 37.62 million customer records may have leaked because of unauthorized access. The data includes email addresses and home addresses of Nitori group members and people who have purchased goods online. Nitori said login passwords and credit card information were not compromised. It said it blocked the access on November 6, fixed the vulnerable point and reported the matter to the Personal Information Protection Commission and police. It warned customers about phishing and suspicious telephone calls and said it would contact affected people by mail or email.

Nikkei reported on November 9, 2026, that the exposed fields for individual members and purchasers included membership numbers, names, email addresses, home addresses, telephone numbers, birth dates and gender. Corporate records may add company names, departments, representative names, company addresses and telephone numbers, plus staff names, email addresses and telephone numbers. ITmedia NEWS reported on November 9, 2026, that order data from Nitori Net and Nitori's official shops inside online malls may also have leaked.

The disclosure came on the same day as another large Japanese breach notice. The Mainichi reported on November 9, 2026, that Sega Corp. said about 2.2 million customer email addresses had leaked after Arara Inc., a contractor it uses for email newsletters, was compromised. Sega said names, telephone numbers, card information and login passwords were not included and that it had not confirmed fraudulent use. Nikkei reported on November 9, 2026, that separate disclosures covered 2.19 million records at Sega and a Sega group toy maker, about 80,000 at a Sumitomo Life related service and about 1.99 million at Shogakukan.

Japan Cyber Watch reported on November 9, 2026, that Nitori ranked as the fourth-largest breach disclosed in Japan this year. It noted that 37.62 million counts records, not people, and that the intrusion route and whether data was actually taken remain unknown. Japan Cyber Watch reported on November 7, 2026, that its list of 2026 breaches affecting a million records or more had risen to 61 entries from 49 a week earlier, while warning that the figures overlap and mix records with people. It put Arara Message at 81.33 million email addresses, MUJI at 27.26 million records including 1.09 million full card numbers, Iris Plaza at about 7.7 million people, Nojima at about 7 million and @cosme at about 3 million.

Analysis

The first judgement is that Nitori's exclusion of passwords and card data is real good news, but it is not a clean bill of health. Names, addresses, telephone numbers, birth dates, gender and order history support convincing phishing, impersonation and telephone fraud. A criminal who knows a customer's name, home address, email address and recent order can construct a message that looks routine. The absence of card numbers lowers the immediate financial loss, but it does not lower the value of the data to an attacker.

The corporate dimension makes the incident more serious than a consumer database leak. Corporate records may include company names, departments, representative names and staff contact details. That information can support business email compromise, invoice fraud and targeted approaches to employees who appear to be dealing with Nitori. Order data from Nitori Net and marketplace shops adds purchase patterns and commercial relationships. What this really means is that the breach is not only a privacy event for individual shoppers but a potential map of business relationships. That should shape how Nitori notifies corporate customers and monitors for follow-on fraud.

The bigger picture here is that Japan's breach wave is exposing a structural weakness in the retail and marketing supply chain. Many of the largest incidents involve contractors, email distribution services, online stores and marketplace operators, not only the brands customers see. Arara Message's 81.33 million email addresses, MUJI's 27.26 million records and Sega's contractor-linked leak point to the same problem: data is concentrated in intermediaries, and one compromise can radiate across many brands. Nitori's 37.62 million records fit that pattern. The company is the public face, but the exposure may have been shaped by how its systems and vendors connect.

The government response is proportionate in speed but incomplete in substance. Japan Cyber Watch reported on November 7, 2026, that the second Cybersecurity Related Ministers' Meeting compiled an emergency package on November 6, with about 10 billion yen from reserve funds, and that the National Police Agency set up a nationwide joint investigation into large breaches since January. Prime Minister Sanae Takaichi asked for a study of amending the active cyber defense law, for critical infrastructure attacks to be reported within hours and at least the same day, and for the National Cybersecurity Office to study detecting suspicious traffic to private companies. The unresolved question is whether after-the-fact investigation and reserve funding can keep pace with breaches measured in tens of millions of records.

Why It Matters

For consumers, the practical risk is concentrated in social engineering rather than card fraud. A leaked name, address, telephone number and order detail gives a caller or email sender enough context to appear credible. Nitori has said it will contact affected customers by mail or email, and customers should treat unexpected messages that ask for passwords, payments or verification codes with suspicion. The usual advice to watch card statements is sensible but not sufficient. People should also watch for impersonation attempts that use information the attacker already knows.

For corporate customers, the risk runs through accounts payable, procurement and employee targeting. A supplier name, department, representative name and staff contact can support a fake invoice or a request to change bank details. Companies that deal with Nitori should verify unusual payment instructions through a separate channel and warn staff about approaches that cite real order data. A corporate membership record may not contain a password, but it can still be enough to start a fraud.

For Japan's regulators and police, Nitori is a test of whether the new response architecture can produce clear public information. The Personal Information Protection Commission and the police are receiving reports, and the National Police Agency has a joint investigation structure. Yet the Nitori notice leaves basic questions open: how the intruder got in, which vulnerable point was fixed, whether data left the system and whether the case involves extortion. The public interest lies in rapid, specific updates rather than a single headline number that may change.

Next Up

Nitori has said the record count may change as its investigation continues, and it has not confirmed that data was actually taken. Affected customers should expect contact by mail or email, and the company's findings will be watched by the Personal Information Protection Commission and police. The next disclosure should clarify the intrusion route, the vulnerable point and any link to other Japanese breaches.

On policy, the emergency package and the National Police Agency's joint investigation will face their first real test in how they handle Nitori and the rest of the 2026 wave. The government has set aside about 10 billion yen and is studying changes to the active cyber defense law, including faster reporting for critical infrastructure. Those measures could improve visibility, but they will not by themselves fix the supply chain weaknesses that keep producing breaches measured in millions of records.