Nitori Holdings said Monday that unauthorized access to its systems may have exposed contact details in up to 37.62 million customer records, making the home-furnishings giant the latest Japanese retailer to warn of a large-scale personal-data incident.
The Sapporo-based company confirmed the intrusion on Nov. 6, cut off access, and hired outside investigators, according to its corporate notice and Nikkei reporting. A log review indicated the breach may have stretched from mid- to late October, longer than first detected.
What may have been copied
Nitori said individual members and online shoppers could see member numbers, names, email and postal addresses, phone numbers, dates of birth, and sex exposed. Business members may have lost company names, department labels, representative names, and corporate contact data, depending on the account.
Order information tied to Nitori Net and the group’s marketplace storefronts may also appear in affected files. Login passwords and credit-card numbers were not compromised, the company emphasized.
Customer risk in Japan
With millions of households holding Nitori member cards, the scale rivals other retail leaks that have fueled phishing waves in Japanese inboxes. Nitori said it would notify affected customers by email or post and warned people to ignore messages asking for passwords or card numbers.
The company told regulators and police about the incident, Kyodo and Sankei reported, though it has not identified attackers or described the entry point publicly. Retail peers from Foreign Ministry contractors to airlines have faced similar unauthorized-access disclosures this year, tightening scrutiny from the Personal Information Protection Commission.
What happens next
Nitori said it patched the weakness used in the intrusion and expanded monitoring. Shares were not halted in Tokyo morning trade, but analysts said investors will watch whether class-action or regulatory fines follow once the commission finishes its review.
Customers can use the inquiry form listed on the corporate site. The company has not set a deadline for completing individual notifications, and the record count could change as investigators reconcile server logs with membership databases.
For now, the retailer is asking shoppers to treat unexpected delivery or points emails as suspicious unless they match prior Nitori correspondence formats. No ransom demand or public hacker claim has been reported.
Security vendors in Tokyo said the October window suggests attackers may have had time to exfiltrate member lists in batches, a pattern seen in last month’s airline and ministry disclosures. Nitori has not said whether two-factor authentication will become mandatory for member logins after the review concludes.
Consumer groups in Osaka and Nagoya urged the chain to publish a plain-language FAQ in addition to the PDF posted on its corporate site, arguing that elderly shoppers who buy bedding in stores may not realize online accounts were merged into the same database. The company’s customer hotline hours were extended Monday but hold times were not disclosed.