The MUJI data breach is an unauthorised access incident disclosed by Ryohin Keikaku on 30 October 2026, in which up to about 27.26 million records including email addresses may have leaked, widening on 4 November 2026 to card numbers in about 1.09 million records. Ryohin Keikaku is the operator of MUJI, and the incident concerns the official MUJI app and, from the second report, the MUJI Online Store. All figures in both company reports are worded as information that may have leaked or may have been accessed from outside, not as confirmed exfiltration, and the company said that no leak to the dark web and no damage from misuse had been confirmed at the time of the second report.
First disclosure
On 30 October 2026, Ryohin Keikaku disclosed unauthorised external access to the official MUJI app, with up to about 27.26 million customer records that may have leaked, including records of customers who had cancelled their memberships. The data in that first report comprised email addresses, dates of birth, gender and member IDs, as summarised in the SmartScope summary of both company reports. The figure is a maximum for records that may have leaked, not a count of confirmed leaked records and not a count of unique individuals. At that stage the company said credit card details, names, addresses and phone numbers were not included, and it warned that spoofing emails misusing the information could be sent. That exclusion was superseded by the second report and no longer stands as the current position.
Second report
Ryohin Keikaku published the second report at 16:36 on 4 November 2026, titled "Possible Leak of Customer Information in the Official MUJI App (Second Report)", according to the company notice on PR TIMES. Further analysis after the first report found that the affected records include MUJI Online Store customers, including people who do not use the MUJI app, and that names, addresses and phone numbers were included for some of those customers. The company notice confirms those categories for some customers, while JapanCyberWatch puts the group with names, addresses and phone numbers at about 520,000 people, attributed here to the JapanCyberWatch summary.
The second report also found that credit card information for some customers may have been accessed from outside, covering some holders of the MUJI Card issued by Credit Saison and some customers who registered card information in the MUJI app or the MUJI Online Store. The Straits Times, reporting from the company announcement, put the card records at about 1.09 million customer records including credit card numbers that may have leaked, with about 345,000 of those MUJI Card records containing full numbers of currently valid cards and dates of birth. The MUJI Card portion covers people who joined the MUJI Card by July 2021, because before July 2021 the company obtained card numbers, MUJI Card IDs and dates of birth of MUJI Card members to grant its own benefits and confirmed that information remained in its system, as stated in the company notice on PR TIMES. Cardholder names, expiry dates and security codes are not included in those records, according to the company. The company has not stated how the card records relate to the 27.26 million records or to the online store group, so the figures in this article are not added together into a single total.
| Report | Scope added | Data categories |
|---|---|---|
| First report, 30 October 2026 | Official MUJI app customers, including former members | Email addresses, dates of birth, gender, member IDs; up to about 27.26 million records that may have leaked |
| Second report, 4 November 2026 | MUJI Online Store customers, including people who do not use the app | Names, addresses and phone numbers for some customers; credit card information for some customers, including full card numbers in about 1.09 million MUJI Card records |
Response, monitoring and customer contact
Ryohin Keikaku said it has blocked the unauthorised external access and strengthened monitoring, which continues, including checks on systems beyond the affected system for impact, and that the MUJI app and MUJI Online Store can be used normally, according to the company notice on PR TIMES. Affected customers will be contacted individually in sequence, by email or postal mail, and Credit Saison will contact MUJI Card members whose contact details the company does not hold. The company asks affected customers to check credit card statements and to contact Credit Saison, the card issuer, about any use they do not recognise, and Credit Saison has strengthened monitoring, with reissue requests directed to Credit Saison. The company also warns about suspicious mail and phone calls pretending to be from the company or a card company, and states that it never asks for credit card information by email or phone.
Customer protection steps
The company contact, card statement check and suspicious message measures are described in Response, monitoring and customer contact above. Email addresses paired with dates of birth, and for some customers names and addresses, make impersonation mail easier to build, so messages claiming to be from MUJI are safer checked by opening the app or the official site directly rather than by clicking a link in the message. Passwords were not listed in either company report, but changing a password reused on other services is sensible general practice. The way leaked addresses get used for impersonation is covered in how phishing uses a leaked email. For loyalty and membership accounts in general, how to protect your email for loyalty programs covers keeping one address per program.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Outstanding investigation details
The investigation remains open, and several points are not yet stated in the sources for this article. The company has not stated the attack vector or the intrusion window, and neither point is guessed at here. The company has not stated whether the data was actually taken out of its systems or published anywhere, only that the information may have been accessed from outside and may have leaked, and it has not given a way for an individual customer to check whether a specific record is included, beyond waiting for the individual contact. The second report superseded the first report exclusion of card details, names, addresses and phone numbers, and any further report could change the scope again, so the figures here are the company position on 4 November 2026, not a final count.
Top comments (0)