The MUJI App data breach is a potential leak of customer information from the official MUJI App operated by Ryohin Keikaku, announced on 30 October 2026, affecting up to approximately 27.26 million records that may contain email addresses, dates of birth and gender. Ryohin Keikaku Co., Ltd., listed on the Tokyo Stock Exchange under code 7453, is the operator of the Muji retail brand, and the announcement concerned unauthorised external access to the official MUJI App. The maximum figure includes records of customers who have since closed their MUJI App accounts, according to reporting of the company announcement. Names, addresses, phone numbers and credit card details were not included in the potentially involved data, according to the same reporting. No leakage to the dark web or other channels and no damage from misuse had been confirmed as of the announcement, so the incident remains a potential leak rather than a confirmed exfiltration.
Incident disclosure
Ryohin Keikaku announced on 30 October 2026 that it had detected unauthorised external access to the official MUJI App and that customer personal information may have leaked externally, according to BigGo Finance, which reported the company announcement. Kyodo News carried the disclosure as a same-day item on 30 October 2026 and added that the official app and its online store continue to operate normally. Dim Sum Daily reported the same scale and the same three data items on the same day, corroborating the figure of up to approximately 27.26 million records. Europe Says corroborated the same figure and the exclusion of names and credit card details. BigGo Finance reported that the company notice was titled "Regarding the Potential Leak of Customer Information in Muji's Official 'MUJI App,'" and that the notice apologised for the concern caused to customers and related parties. The company said it blocked access to the affected systems after detecting the access and implemented corrective measures, according to the reporting of the announcement.
October 2025 Askul disruption
The October 2026 MUJI App incident is distinct from an earlier Muji disruption in October 2025, when ransomware at delivery partner Askul halted Muji online order processing and shipping in Japan. The October 2025 event was a logistics disruption caused by an attack on a partner system, and it was not a leak of MUJI App customer records of the kind announced in October 2026. The October 2026 incident concerns unauthorised access to the MUJI App itself and a potential leak of app customer records, with a different system, a different year and a different issue at stake. The two events are reported as separate incidents, and reporting on the 2026 incident keeps them separate for that reason.
Potentially involved records
The potentially involved data consists of three items only: email addresses, dates of birth and gender, up to a maximum of approximately 27.26 million records. The maximum figure includes information on customers who have since closed their accounts, so former members fall within the same potential scope as current app users. The company has not published a breakdown by country or region in the reporting read for this article, and no statement was reported on whether MUJI App users outside Japan are included in the figure. Individual customers therefore cannot tell from the public announcement alone whether a particular record is among those potentially involved, and no per-customer confirmation mechanism was reported. The combination of the three items is the source of the risk identified in the announcement, because an email address paired with a date of birth and gender allows a sender to address a message with personal detail drawn from the record. That detail does not identify a person by name and does not provide a postal address or a payment method, but it does provide a credible starting point for a message aimed at the inbox that received it.
Data excluded
The company stated that the potentially leaked information does not include names, addresses, phone numbers or credit card details, according to BigGo Finance and corroborated by Kyodo News. The exclusion limits the direct financial exposure arising from the announcement on its own terms, because no card number was reported as involved and therefore no card cancellation follows from this announcement alone. The exclusion also limits the exposure to postal fraud and phone-based account recovery attempts using leaked data, because no postal address or phone number was reported as involved. If a later company statement adds data items to the list, that addition would change the incident materially, and if a later statement confirms external leakage, that confirmation would also change the incident materially. Until either change occurs, the accurate description remains a potential leak of three data items, with the four exclusions intact.
Ryohin Keikaku response
Ryohin Keikaku blocked access to the affected systems after detecting the unauthorised access and implemented corrective measures, according to reporting of the company announcement. The company said it plans to notify affected customers sequentially, and that it will make a further announcement if any external leakage is confirmed in the future, according to the same reporting. Kyodo News reported that the official app and its online store continue to operate normally. The company also issued a specific warning about spoofing emails, warning that emails impersonating Muji or related parties and exploiting the potentially involved information may circulate.
Reporting of the announcement says the company warned that spoofing emails exploiting the potentially involved information may circulate, and asked users who receive suspicious emails not to click embedded URLs or enter personal information.
The company asked users who receive suspicious emails not to click embedded URLs or enter personal information, and that warning applies to former members as well as current app users because the maximum record figure includes former members. No completion date for individual notifications was given in the reporting read for this article, and the notification plan is therefore described only as sequential, in the company's own wording.
Protective measures
The company guidance forms the first protective measure described for affected customers: suspicious emails claiming a connection to Muji are not to be trusted on the basis of a familiar brand name, embedded links in such mail are not to be clicked, and personal information is not to be entered through links in unsolicited mail. A customer who receives a message that appears to come from Muji can open the app or the official site directly, without using any link in the message, and check for the same information there. A second measure concerns the address that was given to the app: checking whether that address appears in known breach data establishes whether it has surfaced elsewhere. A review of other accounts that use the same address follows from the same guidance, and where the same password was reused across services, changing it on the accounts that matter most reduces the value of any future credential combination, even though no passwords were reported as involved in this incident. How phishing uses a leaked email describes the mechanism in detail: a leaked address becomes a target list, and personal details from the same record make the first message more convincing to the recipient.
A third measure concerns loyalty and retail accounts in general, because many retail apps collect an email address at signup and retain it long after the customer stops using the service, which is why former MUJI App members are included in this incident's maximum figure. How to protect an email for loyalty programs sets out the practical form of that measure: an address given to one retailer is kept separate from the address that guards banking, work or primary personal accounts, so that a leak at any single retailer stays contained to that retailer. How to secure an email account covers the account-level steps that apply regardless of which service leaked, including two-factor authentication, and the limit of those steps is that they protect the account itself rather than removing an address from a leaked record. The measures described here reduce the usefulness of the leaked combination to a sender, but none of them withdraws the three data items from circulation once a potential leak has been announced.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
An alias does not remove an address already in a leaked record.
Investigation position
The investigation position as of the announcement is narrow. No leakage to the dark web or other channels had been confirmed, and no damage from misuse had been confirmed, according to reporting of the company announcement. The company has committed to a further announcement if external leakage is confirmed, and to sequential notification of affected customers, but no completion date for those notifications was given in the reporting read for this article. The absence of confirmed misuse is not proof that no data left the company's systems, because the word "potential" in the company's announcement marks the difference between access to a system and confirmed removal of data from it. Equally, the absence of names, addresses, phone numbers and card details is a stated fact of the announcement, not a guess, and it bounds the harm that can follow directly from this incident. The next material facts to watch for are a confirmed external leakage statement, a revised data-item list, or the completion of individual notifications, and until one of those appears, the accurate summary remains the one in the lead: up to approximately 27.26 million MUJI App records, three data items, no confirmed outflow and no confirmed misuse.
Top comments (0)