MUJI App Unauthorized Access Exposes Customer Data and Potential Credit Card Information

Ryohin Keikaku Co., Ltd. has issued a second report on the unauthorized access to its MUJI App that was first disclosed on October 30. The breach initially involved customer email addresses, dates of birth, and gender, but further investigation revealed that names, addresses, and phone numbers were also exposed for some users of both the MUJI App and the Muji online store. Credit card details linked to the MUJI Card issued by Credit Saison, as well as partial card information registered directly in the app or store, may have been accessed by external parties. Approximately 27.26 million records containing basic personal data are affected, with 520,000 of those also including full address and phone details. In addition, full credit card numbers, MUJI Card IDs, and birth dates for about 1.09 million MUJI Card members who joined before July 2021 are potentially compromised, of which 345,000 cards remain valid. The company has blocked further unauthorized access and is monitoring its systems while notifying affected customers individually by email or mail.

ScanNetSecurityNovember 5, 2026Translated from Japanese

Read at source

Ryohin Keikaku Co., Ltd. has released a second report concerning unauthorized access to its official MUJI App, first disclosed on October 30. The company confirmed that customer information stored in the app was potentially exposed to external parties and has been conducting a thorough investigation.

Initial disclosures indicated that email addresses, dates of birth, and gender may have been leaked for customers using the MUJI App. Updated findings now show that the breach also affects users of the Muji online store who do not use the app, and that names, addresses, and telephone numbers were included in some records.

Further analysis revealed that credit card information may also have been accessed. This includes details for customers holding the MUJI Card issued by Credit Saison, as well as customers who registered credit cards directly through the MUJI App or the online store.

The company explained that prior to July 2021 it retained full card numbers, MUJI Card IDs, and dates of birth for MUJI Card members to provide proprietary benefits, and these records remained in its systems.

Affected Data and Scope

MUJI App and Muji online store customers: Email address, date of birth, gender, member ID — up to approximately 27.26 million records. Of these, approximately 520,000 records also contain name, address, and telephone number.
MUJI Card members (joined before July 2021): Full credit card number, MUJI Card ID, date of birth — approximately 1.09 million records (345,000 of which remain valid).
Customers who registered credit cards in the app or store: First six and last two digits of the card number plus cardholder name — approximately 120 records.

Ryohin Keikaku is notifying all affected individuals individually via email or postal mail. The company has blocked further external access, strengthened monitoring across its systems, and confirmed that the MUJI App and online store remain fully operational at this time.

MUJI App MUJI Card Credit Saison Ryohin Keikaku

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Breaches & Leaks

Breaches & Leaks

Unauthorized Access to @cosme Exposes Partial Data of Approximately 3 Million Users

Istyle Inc. announced on November 2 that unauthorized access to its @cosme platform had occurred, with confirmation of the data leak received on October 28. Partial member information belonging to roughly 3 million users registered under the @cosme common ID was exposed to external parties. The compromised data fields include user IDs, nicknames, full names in both kanji and kana, postal codes, addresses, telephone numbers, email addresses, gender, dates of birth, skin type, and hair type. Istyle is contacting all affected customers individually through known contact channels, with the process expected to conclude by November 6. The company has engaged a third-party security firm to determine the root cause and full scope of the incident while implementing measures to limit further damage. Future remediation steps will be developed based on the findings of the external investigation.

ScanNetSecurityNov 5, 2026Translated from Japanese

Breaches & Leaks

DigiCert Discloses Unauthorized Access Exposing Customer Passports, Driver's Licenses and Personal Data

Certificate authority DigiCert has confirmed a data exposure incident involving customer identity documents and personal information. The company discovered unauthorized access to an internal system that stored identity validation materials supplied by customers. The affected system originally resided in a VPN-restricted network but was moved on 4 February 2025 to a publicly reachable network without proper access controls. Attackers could create accounts without multi-factor authentication, and one such account was later found to have accessed customer records. DigiCert identified the external exposure on 21 June, applied fixes on 2 July, and confirmed data access on 19 October. The incident primarily affected names, business email addresses, phone numbers and addresses, while a small subset of accounts also had copies of passports, driver's licenses, utility bills and other identity documents exposed.

Security.NLNov 5, 2026Translated from NL

Breaches & Leaks

Chainalysis Breach Exposes Password Hashes, Usernames, Live Tokens and Personal Data of All Customers

Blockchain analysis firm Chainalysis has confirmed that a cyberattack resulted in the exposure of password hashes, usernames, live tokens, and personal information including names and email addresses belonging to every customer. The company initially reported the incident on 30 October 2026, stating at the time that there were no indications attackers had accessed credentials or investigative data. Chainalysis, which provides blockchain analytics primarily to law enforcement agencies investigating cryptocurrency theft and fraud, later disclosed that the attackers had in fact obtained data from all customer accounts. As a direct result, the firm has reset passwords for every user and is notifying those whose Know-Your-Transaction (KYT) accounts were specifically compromised. KYT is Chainalysis' service that enables businesses to monitor cryptocurrency transactions for compliance and risk purposes. The affected services remain offline while the company continues remediation efforts, and the exact method used to compromise the systems has not been disclosed.

Security.NLNov 5, 2026Translated from NL