Japanese furniture giant Nitori has confirmed that an attacker gained access to a company system and may have stolen 37.62 million customer records. The retailer, often referred to as the “IKEA of Japan,” operates 879 stores domestically and 219 additional stores across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong, generating annual revenue of $5.8 billion.
The breach was detected on November 6, 2026, after which Nitori immediately blocked the unauthorized access. Subsequent investigation revealed that the attacker likely maintained access to the system since mid-October. The incident affects individual customers, corporate members, and non-members who placed orders through official Nitori stores or online shops.
According to the company’s notification, the potentially exposed information includes membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth, and gender for individual members and purchasers. Corporate member data may include company names, department names, representatives’ names, company addresses and telephone numbers, as well as contact persons’ names, email addresses, and telephone numbers. Order information from purchases through Nitori Net and official Nitori shops on e-commerce marketplaces was also at risk.
Nitori stated that account passwords of registered members and credit card information were not exposed. The company has informed Japan’s Personal Information Protection Commission, police, and other relevant authorities. Affected customers will be notified directly by email or post, and the firm has warned that the compromised information could be used in phishing attacks and scam attempts.
Nitori emphasized that it will never request passwords, credit card numbers, or PINs via email or phone. The company has addressed vulnerabilities, strengthened threat monitoring, and urged customers to remain vigilant against social engineering attempts leveraging the stolen data.
