Nitori: up to 37.62 million customer records may have leaked after unauthorised access

How it happened

Unauthorised access by a third party to a system managed by the company, confirmed on November 6 and cut off right away. Log analysis shows access may have begun in mid-to-late October. The company says the cause and the intrusion route are still under investigation, including whether ransomware was involved.[1][2] Checked 11 Nov 2026

What was stolen

Data that may have leaked: for individual members and buyers, membership number, name, email, postal address, phone number, date of birth and gender; for corporate members, company and department, representative and contact names, addresses, phone numbers and emails; order data from the Nitori Net store and its official marketplace shops. Login passwords and credit card data were not exposed.[1][2] Checked 11 Nov 2026

Who was impacted

Customers of Nitori: individual and corporate members and online buyers, up to 37.62 million records. The company says the data held differs from one customer to another and, as of November 11, had not yet determined how many customers are affected. It will notify them by email or post.[1][2] Checked 11 Nov 2026

Threat actor

Not attributed

Timeline

1. 6 Nov 2026Nitori confirms unauthorised access by a third party to a system it manages and cuts it off. [1][2]
2. 9 Nov 2026Nitori Holdings publishes its notice: up to 37.62 million records may have leaked, and log analysis shows access may have begun in mid-to-late October. It has informed Japan's Personal Information Protection Commission and the police, brought in outside specialists and warns customers it will never ask for passwords or card numbers by email or phone. [1]
3. 11 Nov 2026A spokesperson tells BleepingComputer the company is still investigating the cause, including whether ransomware was involved, and has not yet determined the number of customers affected. [2]