Unauthorized Access to @cosme Exposes Partial Data of Approximately 3 Million Users

MUJI App Unauthorized Access Exposes Customer Data and Potential Credit Card Information

Ryohin Keikaku Co., Ltd. has issued a second report on the unauthorized access to its MUJI App that was first disclosed on October 30. The breach initially involved customer email addresses, dates of birth, and gender, but further investigation revealed that names, addresses, and phone numbers were also exposed for some users of both the MUJI App and the Muji online store. Credit card details linked to the MUJI Card issued by Credit Saison, as well as partial card information registered directly in the app or store, may have been accessed by external parties. Approximately 27.26 million records containing basic personal data are affected, with 520,000 of those also including full address and phone details. In addition, full credit card numbers, MUJI Card IDs, and birth dates for about 1.09 million MUJI Card members who joined before July 2021 are potentially compromised, of which 345,000 cards remain valid. The company has blocked further unauthorized access and is monitoring its systems while notifying affected customers individually by email or mail.

DigiCert Discloses Unauthorized Access Exposing Customer Passports, Driver's Licenses and Personal Data

Certificate authority DigiCert has confirmed a data exposure incident involving customer identity documents and personal information. The company discovered unauthorized access to an internal system that stored identity validation materials supplied by customers. The affected system originally resided in a VPN-restricted network but was moved on 4 February 2025 to a publicly reachable network without proper access controls. Attackers could create accounts without multi-factor authentication, and one such account was later found to have accessed customer records. DigiCert identified the external exposure on 21 June, applied fixes on 2 July, and confirmed data access on 19 October. The incident primarily affected names, business email addresses, phone numbers and addresses, while a small subset of accounts also had copies of passports, driver's licenses, utility bills and other identity documents exposed.

Chainalysis Breach Exposes Password Hashes, Usernames, Live Tokens and Personal Data of All Customers

Blockchain analysis firm Chainalysis has confirmed that a cyberattack resulted in the exposure of password hashes, usernames, live tokens, and personal information including names and email addresses belonging to every customer. The company initially reported the incident on 30 October 2026, stating at the time that there were no indications attackers had accessed credentials or investigative data. Chainalysis, which provides blockchain analytics primarily to law enforcement agencies investigating cryptocurrency theft and fraud, later disclosed that the attackers had in fact obtained data from all customer accounts. As a direct result, the firm has reset passwords for every user and is notifying those whose Know-Your-Transaction (KYT) accounts were specifically compromised. KYT is Chainalysis' service that enables businesses to monitor cryptocurrency transactions for compliance and risk purposes. The affected services remain offline while the company continues remediation efforts, and the exact method used to compromise the systems has not been disclosed.