For: individuals who registered as members of Nitori Net or bought through the Nitori Group, and corporate members (business customers). This article is an explanation based on the official notice from Nitori Holdings Co., Ltd.; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
individuals who registered as members of Nitori Net or bought through the Nitori Group, and corporate members (business customers).
- Confirmed so farSee the table ↓
- Discovery of the unauthorized access
- Combination of information
- Contact with affected customers
Listed as possibly affected
- Access before November 6
- Count
- Individual members and purchasers: name (with furigana), address, phone number, email address
3 more
- Individual members and purchasers: member number, date of birth, gender
- Corporate member information
- Order data
- Not yet confirmed
- Cause and route of access
- Scope and final count
- Specific items in the order data
2 more
- Whether secondary harm has occurred
- When affected customers will be contacted individually
- What to do nowSee the steps ↓
- Do not take calls, texts or emails using the name of Nitori or a delivery company at face value
- Check delivery and order messages on a screen you opened yourself
- Do not give out your date of birth or address when asked
2 more
- To find out whether you are affected, contact the official channel
- If you entered details or paid money, get help right away
- Where to verify (source)All sources ↓
- Nitori HD (Nitori Holdings Co., Ltd.), notice of apology and information on possible personal information leakage due to unauthorized access to its system (November 9, 2026, Nitori Holdings website news; PDF, Japanese)
- Last checked
- As of November 10, 2026
Follow-up plans and what we checked
The company says it is still analysing logs and matching data to establish the scope and count, and that these may change as the investigation continues. It says it will announce promptly if new facts that should be disclosed come to light. When we checked the Nitori Holdings news list and the Nitori Net top page on November 10, 2026, we found no follow-up beyond the November 9 notice.
What individual members and purchasers should do today
Do not take calls, texts or emails using the name of Nitori or a delivery company at face value
The company asks customers to be careful with messages impersonating the company, delivery companies or e-commerce malls, and not to open links or attachments they do not recognise. Because address, phone number and name are all included, a message that gets these right can be made (in general).
The company says it never asks for passwords, credit card numbers or PINs by email or phone. Do not reply to a suspicious message; delete it or hang up. For how to spot them, see What is phishing?.
Check delivery and order messages on a screen you opened yourself
These are types that are easy to make look genuine (this site's view; no such messages have been reported in the notice):
- A text saying "we tried to deliver your parcel but you were out", with a URL
- A call or email saying "this is a confirmation of your order" or "there is a problem with your order" and asking for a card number or verification code
- A call that asks when you are home or about your family, in the name of "delivery arrangements" or "confirming payment"
Check your order and delivery status on the official Nitori Net site or app, or the delivery company's official app, that you open yourself, not through a link in the message. If you do not remember ordering anything, you can ignore it.
Do not give out your date of birth or address when asked
The company's notice lists date of birth and gender among the items. A message that says it needs to "verify your identity" and asks for the rest of your details has proved nothing by knowing your name or birthday. Hang up and call back using a contact point listed on the official website.
To find out whether you are affected, contact the official channel
The company says it will contact affected customers by email or post, in turn. If you want to check in the meantime, use the Nitori Holdings customer consultation office (phone 0120-209-993, weekdays, weekends and holidays, 10:00 to 20:00 Japan time) or the official inquiry form.
Use the contact point on the official website, not a number written in an email or text message.
If you entered details or paid money, get help right away
If you entered card details on a page linked from a suspicious message, contact your card issuer immediately. If you entered a password, change it right away, and change it on any other service where you used the same password (Choosing a password manager).
In Japan you can also call the police consultation line (#9110) or the consumer hotline (188).
What corporate members (business customers) should do today
For corporate members, the notice lists the member number, company name, department name, representative's name, company address and phone number, and the contact person's name, email address and phone number as information that may have leaked. Unlike individual members, a named "contact person" and "representative" with contact details are included together.
Confirm payment and bank-account messages through a channel other than email
An invoice that gets the contact person's name, department and company name right, or a message saying "our bank account has changed", is an easy type to make look genuine (this site's view). Before processing an invoice, a bank-account change or a change to a payment date, confirm it by phone using a contact point in your own transaction records, not by replying or by calling a number given in the message.
Inside your company, having someone other than the person who received the request check any bank-account change makes impersonation easier to stop.
Share the same warning with the contact person and the representative
The contact person's name, email address and phone number, and the representative's name, are covered. Be careful with requests that use a position, such as an email in the representative's name telling accounting to "pay this account urgently" (in general).
Tell whoever is the point of contact not to open links or attachments in messages using the Nitori name, and not to answer when asked for a password.
Prepare for calls and emails to your main number and address
The company address and phone number are also covered. If someone using the Nitori name says "because of a system fault, please re-register your member information", do not open the link; check with the contact point on the official website. The company says it never asks for passwords by email or phone.
Use the official channel to check
The customer consultation office (phone 0120-209-993, weekdays, weekends and holidays, 10:00 to 20:00 Japan time) and the inquiry form on the official site are the contact points in the notice. The notice does not give a separate contact point for corporate members.
What happened (from the Nitori Holdings notice)
Nitori Holdings Co., Ltd. posted its notice on November 9, 2026 in the news section of its corporate website, as an "Important notice" (a notice with the same title also appears on the Nitori Net top page). Everything below comes from that notice.
Mid to late October
Log analysis carried out after the November 6 discovery confirmed the possibility that a third party also accessed the system in this period. Details are under investigation.November 6 (Friday)
The company confirmed unauthorized access by a third party to a system it manages. It immediately cut off the access and, with outside specialists, began investigating the cause, route of access and scope.November 9
The company made the incident public, saying personal information held on its servers, up to 37.62 million records, may have leaked externally.
- Discovery
- On November 6, 2026 the company confirmed unauthorized access by a third party to a system it manages
- Count
- Up to 37.62 million records may have leaked (the scope and count may change with further investigation)
- Individual members and purchasers
- Member number, name (including furigana), email address, address, phone number, date of birth, gender
- Corporate members
- Member number, company name, department name, representative's name, company address and phone number, contact person's name, email address and phone number
- Order data
- Order data for the company's products placed through Nitori Net and the official Nitori shop on e-commerce malls
- Not included
- Login passwords and credit card information
- Response
- Access by the attacker has been cut off. The company says it has addressed the vulnerable points and finished strengthening monitoring. It is reporting to and consulting the Personal Information Protection Commission, the police and other bodies
- Contact with affected customers
- By email or post, in turn
- Contact
- Customer consultation office, phone 0120-209-993 (weekdays, weekends and holidays, 10:00 to 20:00 Japan time) and the official inquiry form
What is known and what is not
This table is based on the company's notice of November 9, as of November 10, 2026. When follow-up notices appear, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Discovery of the unauthorized access | Confirmed on November 6 an unauthorized access by a third party to a system the company manages | Confirmed (company) |
| Access before November 6 | Confirmed the possibility that a third party also accessed the system from mid to late October | Possible (company) |
| Count | Up to 37.62 million records may have leaked. It may change with further investigation | Possible (company; upper figure) |
| Individual members and purchasers: name (with furigana), address, phone number, email address | Included in the information that may have leaked | Possible (company) |
| Individual members and purchasers: member number, date of birth, gender | Included in the information that may have leaked | Possible (company) |
| Corporate member information | Member number, company name, department name, representative's name, company address and phone number, contact person's name, email address and phone number | Possible (company) |
| Order data | Order data placed through Nitori Net and the official Nitori shop on e-commerce malls is covered. The specific items are not stated | Possible (company) |
| Login password | Not included in the information that may have leaked | Not included (company) |
| Credit card information | Not included in the information that may have leaked | Not included (company) |
| Combination of information | Differs from customer to customer | Confirmed (company) |
| Cause and route of access | Under investigation with outside specialists | Under investigation |
| Secondary harm | Under investigation. The company warns about suspicious contact | Under investigation |
| Misuse | Not stated | Not stated |
| Current response | Access by the attacker cut off. Vulnerable points addressed and monitoring strengthened | Company's account |
| Contact with affected customers | By email or post, in turn | Confirmed (company; timing not stated) |
What address, phone number, name and date of birth can be used for
With an address, phone number, name, date of birth and email address together, it becomes easier to make a message look as if it came from a company you really ordered from. The points below are what can happen in general; they do not mean it has happened in this incident.
Name + address + phone number
↓→
Calls or texts posing as a delivery notice or order confirmation
→ Do not open links; check order and delivery in the official app
Name + date of birth + gender
↓→
Messages that ask for more details "to verify your identity"
→ Do not answer, even if they know your details; call back
Corporate: company + contact person + representative
↓→
Invoices, bank-account changes, payment requests in the representative's name
→ Confirm through your transaction records, by another channel
What the information that may have leaked can be used for
- Messages with your correct address and name, posing as a delivery or order confirmation
- Invoices or bank-account-change requests that use a contact person's or representative's name
- Messages that lead to fake pages asking for a password or card details
What this information alone cannot do
- Card fraud (the company says card information is not included)
- Log in to a Nitori Net account (the company says login passwords are not included)
- Replace a page you opened yourself from the official app or a bookmark (this site's view)
About the order data
The notice says only that order data placed through Nitori Net and the official Nitori shop on e-commerce malls is covered; it does not list the items inside it. This site does not guess what the order data contains. When a follow-up notice lists the items, we will update the table in this article.
What operators should review: how much personal data you hold, and how far back you look
The cause has not been disclosed, so this section only covers what follows from the published facts.
- Review how much you hold. The notice covers member and purchaser information, corporate member information and order data together, up to 37.62 million records. In general, the more personal data an organisation holds, the wider a single incident reaches. For items the service does not always need, such as date of birth and gender, deciding how long and why you keep them reduces what can leak (in general; we are not saying this is the cause here).
- Look back beyond the day you found it. Here, log analysis after the November 6 discovery found a possibility of third-party access in mid to late October as well. When you find unauthorized access, plan on checking the period before the day you found it too, which means deciding in advance how long logs are kept and where.
Sources (public record)
The facts in this article are based on the public information below. We have not speculated about the cause or the route of access, which have not been disclosed.
- Nitori HD (Nitori Holdings Co., Ltd.), notice of apology and information on possible personal information leakage due to unauthorized access to its system (November 9, 2026, Nitori Holdings website news; PDF, Japanese) — nitorihd.co.jp
- Nitori Holdings Co., Ltd., news list (checked on November 10, 2026; Japanese) — nitorihd.co.jp/news
Update history
2026-11-10: First version, based on Nitori Holdings Co., Ltd.'s notice of November 9. We checked the Nitori Holdings news list and the Nitori Net top page the same day and found no follow-up notice.
Read next
- Same type of incident (e-commerce member data): Unauthorized access to Nojima Online (about 7 million records) / Mr Max member data leak
- Spotting fake emails and texts: What is phishing? / Smartphone security basics
- Passwords: Choosing a password manager
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)