Japanese furniture retailer Nitori breached: names, addresses, emails, phone numbers and birth dates in up to 37.62 million customer records may be stolen; expect scams posing as Nitori

Nitori Holdings, Japan's largest furniture and homeware retailer, disclosed on 9 Nov 2026 (customer notice and Tokyo Stock Exchange filing) that a third party accessed a system it manages. It confirmed the access on 6 Nov and cut it off. Logs show access may have started earlier, mid to late October 2026. Up to 37.62 million records of loyalty members and purchasers (individual and business) may be exposed: member number, name (with kana reading), email, postal address, phone number, date of birth and sex. For business members, company names and department details too. Nitori says login passwords and credit card data were not taken. How the attackers got in is still under investigation and the record count may change. Attacker: unknown.