2026 Nitori: unauthorized access; up to 37.62M customer records
Data compromised
Up to 37.62 million records. This is a record count, and one person can appear more than once. Individual members and buyers: membership numbers, names, emails, postal addresses, phone numbers, dates of birth and gender. Corporate members: membership numbers, company names, departments, representative names, company addresses and phones, and contact names, emails and phones. Online orders placed through Nitori Net and official marketplace shops. Member passwords and credit card numbers were not exposed.
Technical writeup
Root cause
Nitori confirmed unauthorized access to a system it manages on 6 November 2026. The investigation found the attacker likely had access from mid-October. Nitori blocked the access path, fixed the affected systems and increased monitoring. Japan's Personal Information Protection Commission and the police were notified. How the attacker first got in has not been published. Affected customers will be contacted by mail and email.