Nitori notifies possible leak of up to 37.62 million customer records, disclosed Nov 9, 2026
On Nov 9, Nitori disclosed that up to 37.62 million customer records may have been exposed due to unauthorized access; details on specific fields and confirmed misuse are not provided in those excerpts.
- Urgency
- L4
- 77
- 82
- 40
- 70
- 85
At a glance
Nitori Holdings disclosed on Nov 9, 2026 that unauthorized access may have exposed up to 37.62 million customer records. The company filing and subsequent news reports provide the potential exposure figure but do not detail which specific data fields were affected or whether the data have been misused.
- On Nov 9, Nitori disclosed that up to 37.62 million customer records may have been exposed due to unauthorized access; details on specific fields and confirmed misuse are not provided in those excerpts.
CHRONOS Wire · November 11 · Alert 1
What happened
Nitori, a large Japanese home retailer, said on Nov 9 that up to 37.62 million customer records may have been exposed after unauthorized access to its systems. The company has not yet detailed which specific data fields were affected.
Why it matters
The disclosure reports a large number of potentially exposed records and further information from the company or investigators is expected in the near term.
CHRONOS Bottom Line
Nitori disclosed a potential personal-data exposure affecting up to 37.62 million customer records in a Nov 9, 2026 filing. The disclosure does not specify which data fields were accessed or whether the data have been misused.
Full detail
What changed
Nitori issued an initial disclosure on Nov 9, 2026 saying up to 37.62 million customer records may have been exposed after unauthorized access to its systems.
What is genuinely new
Nitori’s Nov 9, 2026 disclosure that up to 37.62 million customer records may have been exposed due to unauthorized access.
Detailed analysis
Public filings and news reports state Nitori disclosed on Nov 9 that up to 37.62 million customer records may have been exposed after unauthorized access. The available excerpts do not identify which specific data fields were accessed, whether payment or authentication data were included or excluded, nor do they confirm any confirmed misuse or data exfiltration. Further company statements or investigation reports are required to determine scope and impact.
U.S. Impact
U.S. Impact assessment pending.