Nitori, Japan’s largest furniture and home goods retailer, says a break-in to its systems may have exposed personal data belonging to as many as 37.62 million people, one of the largest retail breaches reported anywhere this year.
The company disclosed the incident on November 9, saying it discovered unauthorized access to systems it manages on November 6. A third-party investigation traced the intrusion back to sometime between mid and late October, meaning whoever got in may have had weeks of access before anyone noticed. Nitori hasn’t said how the attacker got in, and that part of the investigation is still ongoing.
What was actually taken
The exposure breaks down by customer type. For members and general purchasers, the data includes membership numbers, full names with furigana readings, email addresses, home addresses, phone numbers, dates of birth, and gender. Corporate members had membership numbers, company names, department and representative names, business contact details, and company addresses exposed. Anyone who bought Nitori products through official storefronts on third-party e-commerce marketplaces had their order information caught up in the breach too. Not every record contains every field, the mix varies by how each customer interacted with Nitori, but the breadth of what’s covered is unusual even by the standards of a year that’s had no shortage of retail breaches.
There’s a genuine silver lining here: Nitori says login passwords and credit card numbers were not part of what got exposed. That matters a lot for how seriously affected customers need to treat this. It’s not nothing, a name, address, phone number, and birth date is more than enough to run a convincing phishing campaign, but it’s not the kind of breach where someone’s payment method is now floating around on a criminal forum.
The response, and the timing problem
Nitori says it has already blocked the attacker’s access, patched the vulnerable points it identified, and upgraded its monitoring. It’s working with outside security specialists to pin down the root cause and the full scope, and it says it’s reporting the incident to Japan’s Personal Information Protection Commission and to police. Affected customers will be notified individually by email or postal mail, though Nitori hasn’t given a timeline for when that outreach finishes, and with 37.62 million potential records involved, that’s not going to happen overnight.
The company has also warned customers directly about phishing risk, stating it will never ask for passwords, card numbers, or PINs over email or phone. That’s standard advice, but it’s worth repeating here because a breach notification itself is exactly the kind of event scammers like to piggyback on, sending fake “your Nitori account was compromised, click here to secure it” messages to people who are already primed to be anxious about their data.
Nitori isn’t alone this month. The same week it disclosed its breach, gaming company Sega confirmed roughly 2.2 million customer email addresses were exposed through a contractor’s newsletter system, and Wyndham disclosed a hardcoded-password exposure affecting its own hotel loyalty infrastructure. Japan in particular has had a rough run of retail and consumer breaches in recent months, and Nitori’s is now the largest of the bunch by a wide margin.
What customers should actually do right now
If you’ve ever ordered from Nitori online, through its own site or through a third-party marketplace storefront, the practical advice is fairly simple. Don’t click links in unsolicited emails claiming to be from Nitori, even if they reference real order details, since a surprising amount of personal information is now potentially available to whoever pulled off this breach. Watch for unusual account activity if you have a Nitori membership account, and consider changing your password anyway even though Nitori says passwords weren’t part of what was taken, since reused passwords across sites remain one of the most common ways breaches compound into bigger problems for the people affected by them. If you receive a notification letter or email directly from Nitori about this incident, verify it through the company’s official channels before clicking anything inside it, given how often breach notifications themselves get spoofed by opportunistic scammers within days of a disclosure going public.
Why the scale here matters
Nitori operates more than 800 stores across Japan and several other Asian markets, and it’s been expanding internationally for years. A customer base that size means the 37.62 million figure, while large, is plausible rather than implausible, and Nitori itself has cautioned that the number could still change as the investigation continues. Security researchers tracking the disclosure have noted it’s unclear whether the figure represents individual customers or individual data records, which isn’t the same thing if one person has multiple purchase histories or marketplace orders tied to their name.
Japan’s data protection regime, overseen by the Personal Information Protection Commission, has been tightening in recent years, and companies that suffer breaches of this scale now face real reporting obligations rather than the largely voluntary disclosure norms that governed incidents a decade ago. Nitori confirming it’s reporting to both the Commission and police suggests the company understands the regulatory exposure here goes beyond reputational damage. Whether Japanese regulators pursue a fine or a formal corrective order will depend heavily on what the ongoing investigation into Nitori’s security practices turns up, particularly around why a month-long gap existed between the likely intrusion and its discovery.
A reminder about how long breaches sit undetected
The month-plus gap between the likely intrusion window and Nitori’s discovery of it is a pattern that shows up in breach after breach, not just this one. Attackers who gain access quietly often prefer to stay hidden for as long as possible, mapping out what data is available and exfiltrating it gradually rather than triggering alarms with a single large, obvious transfer. That’s precisely why modern security operations increasingly focus on detecting unusual access patterns and data movement in real time, rather than relying solely on perimeter defenses meant to keep attackers out in the first place. Once someone is inside, the clock on how much damage they can do starts running immediately, and every week that passes before detection is another week of exposure for whatever data they can reach.
The bottom line
No passwords, no card numbers, that’s the good news here, and it’s genuinely good news. But names, addresses, phone numbers, and birth dates for tens of millions of people are now in the hands of someone who shouldn’t have them, and the month-long gap between the likely intrusion window and Nitori’s discovery of it is the part that should worry other retailers watching this unfold. If you’ve shopped with Nitori online or through a marketplace storefront in the past year, treat any email claiming to be from the company with real suspicion until you’ve verified it through Nitori’s own site.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
