MUJI App Unauthorized Access Exposes Customer Data and Potential Credit Card Information
Ryohin Keikaku Co., Ltd. has issued a second report on the unauthorized access to its MUJI App that was first disclosed on October 30. The breach initially involved customer email addresses, dates of birth, and gender, but further investigation revealed that names, addresses, and phone numbers were also exposed for some users of both the MUJI App and the Muji online store. Credit card details linked to the MUJI Card issued by Credit Saison, as well as partial card information registered directly in the app or store, may have been accessed by external parties. Approximately 27.26 million records containing basic personal data are affected, with 520,000 of those also including full address and phone details. In addition, full credit card numbers, MUJI Card IDs, and birth dates for about 1.09 million MUJI Card members who joined before July 2021 are potentially compromised, of which 345,000 cards remain valid. The company has blocked further unauthorized access and is monitoring its systems while notifying affected customers individually by email or mail.
ScanNetSecurityNov 5, 2026Translated from Japanese