The Nitori Data Breach Handed Scammers 37.6 Million Shopping Lists
A man orders a desk in the spring and forgets about it. In November an email arrives with the store’s logo at the top. There is a problem with the delivery address on your order, it says, so please confirm your details. His street address is printed in the message. His name is spelled right. He clicks, because the email already knows him. The Nitori data breach is what makes that message possible, and the follow-up scam is the part that reaches ordinary people.
Confirmation: confirmed by Nitori in a company notice, first reported by BleepingComputer on November 10, 2026.
What happened in the Nitori data breach
Nitori found unauthorized access to a system on its network on November 6, 2026, and shut that access down. Its investigation then showed the intruder had probably been inside since mid-October. Up to 37.62 million records of personal information may have left the company’s servers, according to the notice Nitori published to customers.
Nitori is often called the IKEA of Japan. It runs 879 stores at home and another 219 across China, South Korea, Taiwan, Thailand, Singapore and Hong Kong, on annual revenue of $5.8 billion. The notice covers individual customers, corporate members and non-members who simply placed an order through a Nitori store or online shop.
One number deserves care. 37.62 million is a count of records, not of people, and Nitori told BleepingComputer on November 11 that it has not yet determined how many customers are affected. The company also said the cause is still under investigation, including whether ransomware was involved. So the headline figure is the ceiling on the file, not a confirmed victim count.
What was exposed, and what a stranger can do with each piece
For individual members and purchasers, the exposed fields may include membership numbers, names, email addresses, postal addresses, telephone numbers, dates of birth and gender. For corporate members, they may include company and department names, representatives’ names, company addresses and the contact person’s name, email address and phone number. Order information from Nitori Net and official Nitori shops on e-commerce marketplaces may also be in the file.
Here is what each piece buys an attacker:
- Email address plus order history. This is the pair that makes a fake delivery notice work. The sender can name a real purchase.
- Postal address. Printed in an email, it reads as proof that the sender is legitimate.
- Phone number. Scam texts and voice calls travel on the same list as the email.
- Date of birth and gender. These are identity-verification answers at other companies.
- Membership number. A reference number in a fake message raises the odds that you act.
Nitori also stated what did not leak: account passwords of registered members, and credit card information. That matters, because it narrows the risk to impersonation rather than direct account takeover. Nitori itself warned customers that the stolen data could be used in phishing and scam attempts, and it reminded people that it does not ask for a password, a card number or a PIN by email or on a phone call.
What to do now after the Nitori data breach
Most of this has nothing to do with OptMsg, and it is worth doing anyway. Because the Nitori data breach leaked contact details rather than logins, the work is about spotting impersonation.
1. Treat every order message as unverified for a while. Open the retailer’s own app or type the website address yourself. Then check the order there. Do not use the link in the message. 2. Use a password manager so one leaked login cannot travel between accounts. 3. Turn on the strongest sign-in each account offers. A passkey beats an app code, and an app code beats a text message. 4. Expect the follow-up phish to wear the breached brand. Scammers dress as the company that leaked the list, because that is the company you are already thinking about. 5. Watch your phone as well as your inbox. The same file carries numbers, so smishing arrives alongside the email. 6. Say no to urgency. A real retailer will give you time to log in and look.
This is Black Friday season, which is the worst possible timing. Your inbox is already full of real delivery notices and real discount mail. A fake one hides in that crowd easily.
How OptMsg changes this exposure
OptMsg could not have stopped what happened inside Nitori. The breach took place at another company, on another company’s servers. What an OptMsg inbox changes is what reaches you afterward.
Two things, at their real size. First, your OptMsg account has no password, so a password leaked from some other site cannot be tried against your inbox. Second, mail from a sender you have not approved goes to Trash rather than your Inbox, and Trash empties itself after 30 days. The fake delivery notice is from a sender you did not approve. It lands in Trash, where you can look at it on your own schedule instead of meeting it between two real emails.
What that argument does not cover: a compromised device, a live phishing page you sign in to yourself, or someone holding your unlocked phone. The point is narrower than “you are safe”. It is that the scam built from this leak has to get past a door you control.
Ready to decide who reaches you? Create your OptMsg account and see what an opt-in inbox looks like, or read how the simple-by-design approach works.
Create Your Account — Your Inbox. Your Rules.
Create Your AccountFrequently asked questions
How many people were affected by the Nitori data breach?
Nitori has said the Nitori data breach may have exposed up to 37.62 million records may have leaked, and that it has not yet determined how many customers that represents. Records and people are different counts, so treat 37.62 million as the size of the file.
Were passwords or credit card numbers stolen?
Nitori says no. The company stated that registered members’ account passwords and credit card information were not exposed in this incident.
I shopped at Nitori once as a guest. Am I included?
Possibly. The notice covers individual members, corporate members and non-members who placed orders through Nitori stores and online shops.
What will the scam look like?
Most likely an email or text about an order or a delivery problem, using your real name and address, with a link to a page that asks you to confirm details. Open the retailer’s own app instead and check there.
Will Nitori contact me?
Nitori says it will notify affected customers directly by email or post. It also says it does not ask for a password, a card number or a PIN by email or phone, so a message that asks for one is a scam.
Sources
- BleepingComputer, November 10, 2026 (updated November 11): https://www.bleepingcomputer.com/news/security/japanese-furniture-giant-nitori-says-hackers-stole-376m-customer-records/
- Nitori customer notification, November 6, 2026 (company statement, machine translated): https://www.nitorihd.co.jp/
