Nitori says up to 37.62 million customer records may have been exposed
Nitori confirmed unauthorized access to a system it manages. It says up to 37.62 million records may have been exposed, including member and order data. The count is an upper bound on records. Nitori excludes login passwords and card data.
- Disclosed
- Nov 9, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Individual and corporate members, purchasers and official marketplace shop customers whose records Nitori stored.
- Nitori · data breach · retail
- In the wild
- Yes
- Nitori confirms unauthorized access. The exposure scope remains under investigation.
What happened
The company says the affected combinations differ by customer. Individual member and purchaser data may include membership number, name and phonetic spelling, email, address, phone, birth date and gender. Corporate records may include member number, company and department, representative name, company address and phone, and contact name, email and phone. The announcement also covers Nitori Net and orders placed through official Nitori shops on other marketplaces. Nitori says it blocked attacker access, addressed weaknesses and strengthened monitoring. It continues to reconcile logs and data with outside experts and has not confirmed the total number of people or secondary misuse.
Crime-scene timeline
Nov 6, 2026
Nitori detects and blocks unauthorized access
The company starts an investigation with outside specialists. Logs suggest earlier access was possible.
Nov 9, 2026
Nitori publishes its disclosure
The company reports the possible record scope and plans individual notices by email or post.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Nitori November 9 disclosure on TDnetPrimaryConfirms unauthorized access, gives the maximum potentially exposed record count and field groups, and describes containment and notification.