Nitori Investigates Potential Leak of Up to 37.62 Million Records
Japanese company Nitori Holdings is investigating a potential data leak involving up to 37.62 million records after unauthorized access. According to the company, passwords and payment card data were not affected.
Nitori data leak: Nitori is investigating a potential data leak after the company detected unauthorized third-party access to its system on November 6. The company blocked the access, but its investigation so far indicates that up to 37.62 million personal data records may have been leaked externally.
The figure is preliminary and may change. Nitori is continuing to analyze system logs and compare data, so it has not yet disclosed the number of unique people potentially affected by the incident. It has also not been confirmed whether the attacker actually exfiltrated the data; the company refers to the possibility of a leak.
Potential Nitori data leak may affect customers and orders
Potentially affected data includes information about individual customers and buyers, corporate members, and orders. The scope also includes data from the Nitori Net online store and Nitori’s official stores on e-commerce platforms.
The company has not specified the exact combination of data in individual records. Importantly, according to its statement, passwords and payment card data are not among the potentially leaked information.
However, this does not rule out the misuse of other personal and order data in social engineering. In such campaigns, attackers may impersonate a retailer, carrier, or online marketplace and refer, for example, to a specific order or package delivery.
Company deploys remediation and strengthens monitoring
Nitori said it deployed a fix for the vulnerability and strengthened system monitoring. It is cooperating with external experts on the investigation. The company is also handling the case with Japan’s Personal Information Protection Commission and the police.
The cause of the incident, the method of intrusion, and the attackers’ identities have not yet been disclosed. Possible links to ransomware also remain under investigation. Without a completed forensic review, it is not known whether the data was merely accessible to an unauthorized party or was also taken from the system.
What customers should watch for
Nitori customers should be cautious with unexpected emails, text messages, and phone calls impersonating the company, carriers, or online marketplaces. They should not open unsolicited links or attachments, and should verify communications directly through the company’s official channels.
In further announcements, it will be important to see whether Nitori revises its estimate of potentially leaked records, determines the number of affected individuals, and clarifies the types of data involved. Findings about the intrusion vector, possible exfiltration, and customer notifications are also expected.
Sources
- Nitori Holdings – The official announcement confirms the detection of unauthorized access on November 6, up to 37.62 million potentially leaked records, the scope of the data, the exclusion of passwords and card data, and the measures taken.
- BleepingComputer – Reports that a Nitori spokesperson confirmed on November 11 that the investigation into the cause, including the ransomware question, is ongoing and that the number of affected customers has not yet been determined.
Verified and updated: November 11, 2026 15:22
