Now Hacked
EN-GB
Data breach

MUJI warns of possible leak of 27.26 million customer records and 1.09 million card numbers

First reported · Last reported · 107 related reports

Unauthorised access to systems at MUJI operator Ryohin Keikaku may have exposed up to approximately 27.26 million app and online shop customer records, including those of former members, and approximately 1.09 million card numbers. The customer information included email addresses, dates of birth and gender, while the card numbers had been collected for a benefits programme that ended in 2021 and were never deleted. The company acknowledged vulnerabilities in parts of its systems and shortcomings in information security and customer data management, reported the incident to the relevant authorities and said it would strengthen internal controls. It also postponed reopening its online shop because of possible unauthorised logins.

Key facts

Affected organisation
Ryohin Keikaku
Incident type
Data breach
Occurred / detected
2026-10
Scale of damage
Possible exposure of up to approximately 27.26 million customer records and approximately 1.09 million card numbers
Cause / method
Unauthorised external access, vulnerabilities in parts of the systems, and management shortcomings including failure to delete unnecessary card information
Location
Japan

If your data was exposed

Exposed dataEmailDate of birthCard details

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
  2. Turn on payment alerts in your card issuer’s app, and if you see a charge you don’t recognise, ask the issuer to block and reissue the card.

Timeline

  1. The possible exposure of up to approximately 27.26 million MUJI app customer records, including those of former members, was disclosed.
  2. The possible exposure of personal information, including card numbers, associated with approximately 1.09 million MUJI Card memberships was disclosed.
  3. The potentially exposed card numbers were found to have been collected for a benefits programme that ended in 2021 and never deleted.
  4. The online shop's reopening was postponed because of possible unauthorised logins through credential stuffing.
  5. Ryohin Keikaku's president acknowledged vulnerabilities in parts of the systems and shortcomings in customer data management, apologised, and announced that the incident had been reported to the relevant authorities and that internal controls would be strengthened.

107 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.