Nitori Holdings, the Japanese home furnishings giant often described as the IKEA of Japan, says an intruder may have walked off with up to 37.62 million records tied to its shoppers and members. The company confirmed the unauthorized access on November 6, but log analysis now suggests the attacker was already inside its systems in mid to late October.
The disclosure, published on November 9 as a customer notice and a filing to the Tokyo Stock Exchange, makes Nitori the latest and largest name in a run of Japanese companies reporting data incidents this autumn.
Weeks of possible access before detection
According to Nitori, it detected unauthorized access by a third party to a system it manages on November 6, cut off the attacker’s access the same day and brought in outside specialists to investigate. That follow-up work found signs that the same third party may have accessed the system before the discovery, with possible activity dating to mid to late October.
The company says it has already fixed the weak point that was abused and strengthened its monitoring. It has not disclosed how the attacker got in, what kind of system was breached or whether any ransom demand was made. Investigators are still working through logs and matching data, and Nitori warns the 37.62 million figure could change as that work continues.
No ransomware or extortion group has publicly claimed the attack at time of publication.
Members, buyers and corporate accounts all in scope
The 37.62 million figure is a ceiling on records, not a confirmed count of individuals. Nitori says the combination of exposed fields differs from customer to customer. The possibly exposed data falls into three groups:
- Individual members and purchasers: membership numbers, names including phonetic readings, email addresses, postal addresses, phone numbers, dates of birth and gender
- Corporate members: membership numbers, company and department names, representatives’ names, company addresses and phone numbers, and contact persons’ names, email addresses and phone numbers
- Online orders: order data from the
Nitori Netonline store and Nitori’s official shops on third-party e-commerce marketplaces
Nitori says login passwords and credit card information were not among the data that may have leaked.
Why the missing passwords do not end the risk
Even without card numbers, a dataset that ties names, home addresses, phone numbers, birth dates and purchase records together is valuable to scammers. Order histories in particular let fraudsters write convincing fake delivery notices, refund offers or account alerts that reference real purchases.
Nitori itself flagged that risk, warning customers to watch for impersonation emails, phishing and suspicious phone calls posing as Nitori, delivery companies or e-commerce marketplaces. The company says it will never ask for passwords, card numbers or PINs by email or phone, and it told customers not to open unfamiliar links or attachments. Corporate members face a parallel risk of business email compromise, since their contact names and roles were in scope.
Regulators notified, impact called limited
Nitori says it is reporting the incident to Japan’s Personal Information Protection Commission and consulting police and other authorities. Affected customers will be contacted individually by email or postal mail. In its exchange filing, the company said it currently expects the impact on consolidated earnings to be limited, though it is still reviewing the costs.
The size of the exposure puts Nitori well ahead of other recent Japanese retail incidents. Muji operator Ryohin Keikaku reported up to 27.26 million app and online store records at risk earlier this month, while Lawson confirmed 2.15 million customer records were exposed. Separately, a breach at email delivery provider Arara exposed up to 77 million email addresses belonging to customers of around 380 corporate clients.
Nitori operates 879 stores in Japan and more than 200 across China, South Korea, Taiwan, Thailand, Singapore and Hong Kong. The company has not said whether customers outside Japan are affected. Customers who shop with Nitori online should treat any unexpected message referencing their orders or membership with caution until the investigation concludes.
