{
  "id": "nitori-customer-records",
  "url": "https://ohshit.app/incidents/nitori-customer-records/",
  "title": "Nitori says up to 37.62 million customer records may have been exposed",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-09",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Nitori",
    "data breach",
    "retail"
  ],
  "ecosystems": [],
  "summary": "Nitori confirmed unauthorized access to a system it manages. It says up to 37.62 million records may have been exposed, including member and order data. The count is an upper bound on records. Nitori excludes login passwords and card data.",
  "splash": "Individual and corporate members, purchasers and official marketplace shop customers whose records Nitori stored.",
  "wipe": "Verify messages through Nitori’s official support and watch for impersonation of the retailer, marketplaces or carriers.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify exposure through official support",
      "hint": "Use the official customer inquiry form linked below. Keep any direct notice and check which fields were involved."
    },
    {
      "title": "Treat unexpected delivery and account messages carefully",
      "hint": "Open the known Nitori or marketplace site directly. Avoid unexpected links and attachments. If contacted for passwords, card numbers or PINs, use official support to verify and report the request."
    }
  ],
  "sources": [
    {
      "name": "Nitori November 9 disclosure on TDnet",
      "url": "https://www.release.tdnet.info/inbs/140120261109569598.pdf",
      "says": "Confirms unauthorized access, gives the maximum potentially exposed record count and field groups, and describes containment and notification.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Nitori confirms unauthorized access. The exposure scope remains under investigation.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 6, 2026",
      "title": "Nitori detects and blocks unauthorized access",
      "body": "The company starts an investigation with outside specialists. Logs suggest earlier access was possible."
    },
    {
      "date": "Nov 9, 2026",
      "title": "Nitori publishes its disclosure",
      "body": "The company reports the possible record scope and plans individual notices by email or post."
    }
  ],
  "body_markdown": "The company says the affected combinations differ by customer. Individual member and purchaser data may include membership number, name and phonetic spelling, email, address, phone, birth date and gender. Corporate records may include member number, company and department, representative name, company address and phone, and contact name, email and phone. The announcement also covers Nitori Net and orders placed through official Nitori shops on other marketplaces. Nitori says it blocked attacker access, addressed weaknesses and strengthened monitoring. It continues to reconcile logs and data with outside experts and has not confirmed the total number of people or secondary misuse.\n\n[Official Nitori customer inquiry form](https://www.nitori-net.jp/ec/input-inquiry?inquiryRecordCode=04000000)"
}