INCIDENT REPORT · CP-2026-015
Nitori Customer Data Breach
L3 · ELEVATEDCONFIRMED
Japanese furniture retailer Nitori Holdings disclosed on Nov 9, 2026 that unauthorized access confirmed on Nov 6 may have exposed up to 37.62 million personal-information records; log analysis indicated third-party access may also have occurred in mid-to-late October. Exposed fields may include names, addresses, phone numbers, email addresses, dates of birth and order data, but not passwords or card details.
- Incident ID
- CP-2026-015
- Disclosure date
- 09 NOV 2026
- Detection date
- 06 NOV 2026
- Affected countries
- Japan
- Plotted location
- Sapporo, Japan (Affected organization headquarters)
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Very large potential exposure of personal data at a major national retailer.
- Attack type
- Data Breach
- Nature
- Malicious activity
- Attack vector
- Not publicly documented
- Sectors
- Retail
- Critical infrastructure
- No
- Organizations affected
- Nitori Holdings
- Operational consequences
- Up to 37.62 million records (an upper bound, not a confirmed count) of individual customers, corporate members and online/store purchasers may have been leaked; Nitori blocked the access, reported to Japan's Personal Information Protection Commission and police, and warned of phishing risk.
- Estimated financial impact
- No reliably documented figure
- Attribution (as stated)
- No official attribution recorded
SOURCE REFERENCES
- [1] Cyberattack puts 37.62 million Nitori customer records at riskThe Star · thestar.com.my · 09 NOV 2026
- [2] Nitori reports data breach affecting 37.62 million customer recordsSC Media · scworld.com
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.