Nitori Holdings said on 9 November 2026 that up to 37.62 million records of personal information held on its servers may have been leaked externally after unauthorized access to systems it manages. The company said login passwords and credit-card information are not among the data that may have been exposed.
What may have gone out
The figure is a ceiling, and the company calls it a possibility, not a confirmed leak. Nitori said the count and scope could change as log analysis and data matching continue. The notice counts records, not people, and it does not say how many individuals are affected. The mix of data differs from customer to customer.
The data that may have been exposed falls into three groups, according to the company's notice:
- Individual members and buyers of products from the Nitori group: member number, name (including the phonetic reading), email address, address, phone number, date of birth and gender.
- Corporate members: member number, company name, department, representative's name, company address and phone number, and the contact person's name, email address and phone number.
- Order data for products bought through Nitori Net and through Nitori's official shop on e-commerce malls.
How the intrusion unfolded
Nitori said it confirmed the unauthorized access on Friday 6 November 2026, blocked it at once and began an investigation with an external specialist body. Log analysis after the discovery then indicated that a third party may have accessed the systems before 6 November, with a possible window of mid-to-late October. Nitori said details are still under investigation.
Containment and reporting
Nitori said it is keeping the attacker's access blocked, has addressed the vulnerable points and has finished strengthening its monitoring. With the external specialists it is still examining the cause, the route of entry, the scope and whether any secondary harm has occurred. Affected customers will be contacted in turn by email or post.
The company said it is in the process of reporting to, and consulting with, the Personal Information Protection Commission and the police. It plans to review access control, authentication and privilege management, and monitoring, and to implement measures to prevent a recurrence.
Phishing warning and financial impact
Nitori warned that the data could be misused in impersonation emails, phishing and suspicious calls, including messages posing as Nitori, delivery firms or e-commerce malls. It said it never asks customers by email or phone for passwords, card numbers or PINs.
On earnings, Nitori said it is still assessing the effect but expects the impact on consolidated results to be limited on the basis of what it currently knows. It did not give a figure.