On 4 November 2026, Ryohin Keikaku, the company behind MUJI, published a second report on the breach of its MUJI app that it first disclosed on 30 October. The first report said only email addresses, birth dates and gender were involved and that no credit card information was included. The new report reverses that.
MUJI Card: for about 1.09 million members of MUJI Card, the credit card issued by Credit Saison, who joined by July 2021, the full card number, MUJI Card ID and date of birth may have been accessed. About 345,000 of these cards are still valid; the rest have expired or been cancelled. Cardholder names, expiry dates and security codes are not included, according to the company. Until July 2021, MUJI collected these card numbers to give MUJI Card members their own benefits, and the data stayed in its systems.
A wider scope: the breach now also covers MUJI online store members who don't use the app. The maximum stays at about 27.26 million records, including former members, and member IDs were added to the exposed fields. For about 520,000 records, names, addresses and phone numbers may also have been accessed. For about 120 cards registered in the app or online store, the first 6 and last 2 digits and the cardholder name may be exposed.
Response: the company says outside access has been blocked. It has found no leak to the dark web and no misuse so far, and the app and online store work normally. Affected people will be contacted by email or post. Credit Saison is stepping up fraud monitoring, will reissue cards on request, and will contact MUJI Card members MUJI has no contact details for. How the attackers got in has not been disclosed, and the investigation continues.
