{"id":"CMP-202611-na4m7r","kind":"campaign","aliases":[],"related":[],"title":"Japanese furniture retailer Nitori breached: names, addresses, emails, phone numbers and birth dates in up to 37.62 million customer records may be stolen; expect scams posing as Nitori","description":null,"summary":"Nitori Holdings, Japan's largest furniture and homeware retailer, disclosed on 9 Nov 2026 (customer notice and Tokyo Stock Exchange filing) that a third party accessed a system it manages. It confirmed the access on 6 Nov and cut it off. Logs show access may have started earlier, mid to late October 2026. Up to 37.62 million records of loyalty members and purchasers (individual and business) may be exposed: member number, name (with kana reading), email, postal address, phone number, date of birth and sex. For business members, company names and department details too. Nitori says login passwords and credit card data were not taken. How the attackers got in is still under investigation and the record count may change. Attacker: unknown.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Nitori","note":"Nitori Group loyalty members and online purchasers; access mid-Oct to 6 Nov 2026","fixed":[],"ecosystem":"saas"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Are you or your company a Nitori member, or have you bought from Nitori online? Then your details may be in the stolen data.\n- Nitori warns of phishing emails and suspicious phone calls that use the stolen data. Treat any message or call claiming to be Nitori, about this breach, compensation or your account, as suspect. Nitori says it will contact affected customers by mail or email.\n- Sender and link domains used by scammers: unknown.","fix":"- Do not click links in or reply to unexpected Nitori-themed emails, texts or calls. Check them on Nitori's official site instead.\n- Watch for targeted phishing that uses your name, address, phone number or birth date.\n- Passwords and card data were not reported stolen, but change your Nitori password if you reuse it elsewhere.","status":"open","published_at":null,"first_seen_at":"2026-11-10T20:57:23+00:00","triaged_at":"2026-11-10T20:57:23+00:00","updated_at":"2026-11-10T20:59:15+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-10T21:01:42Z","path":"phishing","entry":"unknown","reason":"The record says how the attackers got in is still under investigation, while customers are warned of phishing emails and calls that use the stolen data.","confidence":0.7}},"analyst_status":"done","analyst_note":null,"search":"'-202611':30A '2026':50B,89B '37.62':17A,92B '6':72B '9':48B 'access':62B,70B,80B 'address':7A,114B 'attack':144B,157B 'birth':12A,119B 'breach':5A 'busi':102B,123B 'campaign':33B 'card':137B 'chang':156B 'cmp':29A 'compani':125B 'confirm':68B 'count':154B 'credit':136B 'custom':19A,51B 'cut':75B 'data':138B 'date':13A,117B 'depart':128B 'detail':129B 'disclos':46B 'earli':35B 'earlier':84B 'early-warn':34B 'email':8A,112B 'exchang':56B 'expect':24A 'expos':105B 'file':57B 'furnitur':2A,42B 'got':145B 'hold':38B 'homewar':44B 'individu':100B 'investig':150B 'japan':39B 'japanes':1A 'kana':110B 'largest':41B 'late':87B 'log':78B 'login':133B 'loyalti':96B 'manag':66B 'may':21A,81B,103B,155B 'member':97B,106B,124B 'mid':85B 'million':18A,93B 'na4m7r':31A 'name':6A,108B,126B 'nitori':4A,28A,32A,37B,131B 'notic':52B 'nov':49B,73B 'number':10A,107B,116B 'octob':88B 'parti':61B 'password':134B 'phone':9A,115B 'pose':26A 'postal':113B 'purchas':99B 'read':111B 'record':20A,94B,153B 'retail':3A,45B 'say':132B 'scam':25A 'sex':121B 'show':79B 'start':83B 'still':148B 'stock':55B 'stolen':23A 'system':64B 'taken':141B 'third':60B 'tokyo':54B 'unknown':158B 'warn':36B","nicknames":["Nitori breach"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["nitori","nitoribreach"],"ptokens":["nitori"],"labels":["campaign","earlywarning","medium","vendor"],"campaign_type":"breach","search_a":"'-202611':30A '37.62':17A 'address':7A 'birth':12A 'breach':5A 'cmp':29A 'custom':19A 'date':13A 'email':8A 'expect':24A 'furnitur':2A 'japanes':1A 'may':21A 'million':18A 'na4m7r':31A 'name':6A 'nitori':4A,28A,32A 'number':10A 'phone':9A 'pose':26A 'record':20A 'retail':3A 'scam':25A 'stolen':23A","search_b":"'2026':50B,89B '37.62':92B '6':72B '9':48B 'access':62B,70B,80B 'address':114B 'attack':144B,157B 'birth':119B 'busi':102B,123B 'campaign':33B 'card':137B 'chang':156B 'compani':125B 'confirm':68B 'count':154B 'credit':136B 'custom':51B 'cut':75B 'data':138B 'date':117B 'depart':128B 'detail':129B 'disclos':46B 'earli':35B 'earlier':84B 'early-warn':34B 'email':112B 'exchang':56B 'expos':105B 'file':57B 'furnitur':42B 'got':145B 'hold':38B 'homewar':44B 'individu':100B 'investig':150B 'japan':39B 'kana':110B 'largest':41B 'late':87B 'log':78B 'login':133B 'loyalti':96B 'manag':66B 'may':81B,103B,155B 'member':97B,106B,124B 'mid':85B 'million':93B 'name':108B,126B 'nitori':37B,131B 'notic':52B 'nov':49B,73B 'number':107B,116B 'octob':88B 'parti':61B 'password':134B 'phone':115B 'postal':113B 'purchas':99B 'read':111B 'record':94B,153B 'retail':45B 'say':132B 'sex':121B 'show':79B 'start':83B 'still':148B 'stock':55B 'system':64B 'taken':141B 'third':60B 'tokyo':54B 'unknown':158B 'warn':36B","search_c":"","cause_entry":"unknown","cause_path":"phishing","disclosures_checked_at":"2026-11-10T21:06:26+00:00","first_public_at":"2026-11-09T08:46:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-na4m7r","url":"https://cybersixt.com/originals/nitori-says-attackers-may-have-taken-37-62-million-customer-records","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T20:57:23+00:00","fetched_at":"2026-11-10T20:57:23+00:00","note":null,"cites":["https://cybersixt.com/originals/nitori-says-attackers-may-have-taken-37-62-million-customer-records"]}],"documents":[{"id":118328,"url":"https://x.com/BleepinComputer/status/2120258997324218582","title":"@BleepinComputer: Japanese furniture giant Nitori says hackers stole 37.6M customer records\nhttps:","kind":"post","source":"x","publisher":null,"text":"Japanese furniture giant Nitori says hackers stole 37.6M customer records\nhttps://t.co/WrTcZACFZm\n\nhttps://t.co/WrTcZACFZm\n\nlikes 3 reposts 1","published_at":"2026-11-10T20:55:12+00:00","relation":"describes","confidence":null,"note":null},{"id":118462,"url":"https://cybersixt.com/originals/nitori-says-attackers-may-have-taken-37-62-million-customer-records","title":"Nitori says attackers may have taken 37.62 million customer records","kind":"blog","source":"analyst","publisher":null,"text":"Nitori Holdings, Japan's largest furniture and homeware retailer, says personal data in up to 37.62 million records may have been taken from its servers. Notice to customers on Monday 9 Nov, also filed with the Tokyo Stock Exchange: confirmed unauthorised access by a third party to a system it manages on Friday 6 Nov, cut access off, brought in outside specialists. Log analysis shows attackers may have had access earlier, mid to late October. Still investigating how they got in; record count may change. Records: loyalty members and purchasers - member number, name and kana, email, postal address, phone, date of birth, sex; business member info (company names, departments). Login passwords and credit card data not compromised. Nitori warns customers about phishing and suspicious phone calls; will contact affected customers by mail or email.","published_at":"2026-11-09T08:46:01+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}