Nitori breach exposes data on 37.6 million customers

Nitori says a cyberattack on 9 November 2026 breached its management servers, exposing up to 37.6 million records. The incident targets both individual customers and enterprise buyers, with personal data including membership numbers, full names, home addresses, phone numbers, email addresses, birthdates and genders. Corporate records were also affected, revealing company names, departments, executive representatives, corporate addresses and direct contact details.

Nitori emphasises that the breach appears concentrated on domestic Japanese shoppers and procurement partners, and there is no evidence that international customer databases were exfiltrated.

In the wake of the intrusion, the retailer warned that stolen order histories could fuel impersonation and social engineering campaigns, given attackers possess genuine purchase records and addresses. Affected individuals will be notified by email and traditional postal mail. Nitori has reported the incident to Japan’s Personal Information Protection Commission and to law enforcement authorities. The company urged vigilance against unsolicited refund calls or fraudulent messages.

The official security incident notice cited in the disclosure provides the scope of data exposed, and officials framed the breach as a reminder of the need for robust access controls across retail management infrastructure.