The Store Looked Fine. 37.6 Million Records Were Gone.

Japan’s biggest furniture chain looked fine from the outside. Inside, an intruder had been moving through its systems for weeks. Nitori — often called the “IKEA of Japan” — disclosed on November 10 that an attacker may have stolen up to 37.62 million customer records, and that the company only discovered the break-in on November 6, weeks after it began.

Nitori is not a small target. The company runs 879 stores in Japan and another 219 across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong, with annual revenue of $5.8 billion. The breach reaches individual customers, corporate members, and non-members who placed orders through Nitori stores and online shops — essentially anyone who has bought from the chain.

What happened, and what was taken

According to Nitori’s notification, the company confirmed unauthorized access by a third party to one of its systems on November 6, 2026, and blocked the access promptly. Its investigation found the attacker likely had access since mid-October — roughly three weeks of quiet presence before detection. Nitori has not said how the attacker got in, or who is behind it.

The potentially exposed information is the kind that powers identity theft and phishing for years. For individual members and purchasers: membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth, and gender. For corporate members: company names, department names, representatives’ names, company addresses and telephone numbers, and contact persons’ names, emails, and phone numbers. Online order information for purchases through Nitori Net and official Nitori shops on e-commerce marketplaces is also in scope.

There is one piece of genuinely good news. Nitori says account passwords and credit card information were not exposed in this incident. That limits the direct damage — nobody can log in as a Nitori customer or charge their card with what was taken. But it does not limit the secondary damage. With a name, address, phone number, birth date, and order history, an attacker can write a phishing email that looks exactly like a real message from a store the victim actually shops at.

Nitori warned customers directly about that risk: the compromised information could be used in phishing attacks and scams, and customers should stay alert. The company also stressed that it will never ask customers for their password, credit card number, or PIN by email or in phone conversations — a line worth remembering, because the first wave of scams after a breach like this usually arrives pretending to be the company itself.

Why this breach fits a pattern

Retail breaches keep landing in the same place: a third-party system or a single internal system holding years of customer records, discovered weeks after the intrusion started. The details differ, but the shape is familiar — Iris Ohyama’s cloud breach exposed 7.7 million shoppers just two days ago, and SEGA’s newsletter provider leaked 2.2 million email addresses the same day. Nitori’s 37.6 million is the largest of the three, and the longest-lived intrusion.

Nitori says it has addressed the vulnerabilities in its systems and strengthened threat monitoring. It has informed Japan’s Personal Information Protection Commission, the police, and other relevant authorities, and promised to notify affected customers directly by email or post.

The open questions are the ones that matter most to customers: exactly which records were taken, and whether the stolen data has shown up anywhere yet. Nitori has not answered either. Until it does, every Nitori customer should assume their details are in circulation.

What to do if you shop at Nitori

1. Expect phishing, and treat every Nitori email as suspect. Attackers now know your name, address, and what you bought. A message about an order problem, a delivery, or a refund that uses those details is not proof it is real. Go to the Nitori site or app yourself instead of clicking links.

2. Remember what Nitori will never ask for. The company will never ask for your password, credit card number, or PIN by email or phone. Any message that does is a scam, no matter how convincing the rest of it looks.

3. Watch for identity-theft signs. With birth dates and addresses in the wild, keep an eye on account statements, credit reports, and any unexpected account activity. Consider placing a fraud alert or credit freeze if your country offers one.

4. Change your Nitori password anyway. Passwords were not exposed, but a breach is a good moment to make sure the password is unique and not reused anywhere else. If you used the same password on another site, change that one too.

The store looked fine. The records were already gone. For 37.6 million people, the breach is not the break-in — it is the phishing that comes next.