Nitori, Japan's biggest furniture chain, says hackers may have taken 37.62 million customer records. Passwords and cards are said to be safe, but scams may follow.
Nitori, the Japanese furniture chain often called the "IKEA of Japan," says a hacker may have copied up to 37.62 million customer records. The company found the break-in on November 6 and blocked it. Its investigation suggests the attacker likely had access since mid-October.
Nitori says an outsider got into a system on its network. The records cover individual customers, corporate members and non-members who ordered through official Nitori stores and online shops. The company says the records "may have been" leaked, so theft is possible but not confirmed.
Nitori runs 879 stores in Japan and 219 more in China, South Korea, Taiwan, Thailand, Singapore and Hong Kong. Anyone who ordered from it could be in the affected group. People who never ordered from Nitori have no reason to worry about this case.
The company says account passwords and credit card details were not exposed. That limits the damage. Still, personal details alone can power convincing scam messages. Nitori warned that the data could be used in phishing, which means fake emails or calls built to trick people into giving up money or secrets. It says it will never ask for a password, card number or PIN by email or phone. The alert box above lists the steps to take.
Some things are not known yet, including exactly which details were in the records and how the attacker got in. Nitori has told Japan's Personal Information Protection Commission and the police. It says it will notify affected customers directly by email or post.
If you ever ordered from Nitori, treat any message mentioning it with suspicion and never share a password, card number or PIN.
Some scams now pass every bank security check, and UK losses from payments that victims approve themselves reached £576.4m in 2025.
Read more: Fraud that passes every security check is a growing problemA flaw in an open-source AI tool let an attacker into a NEAR AI server and out with account data on about 100 users. Here is who is affected and what to watch for.
Read more: Hackers broke into NEAR AI's servers and took data on about 100 usersA hacker used stolen Qubole keys to enter customers' Amazon cloud accounts and download data. Any company that ever linked Qubole to AWS should check.
Read more: Hackers used a data vendor's keys to steal from dozens of firms
