Illustrative image: a MUJI storefront in Paris. The disclosure concerns customer data from the official MUJI App, not a store system. Image: Wikimedia Commons.
TL;DR: MUJI app data leak 27 million customer records explained in one line: Ryohin Keikaku, the Japanese company behind MUJI, said on 30 October 2026 that unauthorised access to its official MUJI App may have leaked up to 27.26 million customer records — email addresses, dates of birth and gender — with no names, addresses, phone numbers or card details involved and no confirmed misuse so far.
📌 KEY HIGHLIGHTS
- Up to 27.26 million records potentially affected: Ryohin Keikaku's own announcement, reported by Kyodo News and Reuters on 30 October 2026, covering current and former MUJI App members.
- What leaked (potentially): email addresses, dates of birth and gender only — the company says names, addresses, phone numbers and credit card details were NOT included.
- What is NOT confirmed: no leakage to the dark web or other channels and no damage from misuse has been confirmed so far, the company said.
- Company response: access to the affected systems has been blocked, corrective measures implemented, and affected customers will be notified in sequence.
- Watch out for phishing: a leaked email address plus date of birth is exactly the combination used for targeted phishing and account-takeover attempts — treat unexpected MUJI emails with suspicion.
MUJI app data leak: what happened?
Ryohin Keikaku Co., the Tokyo-listed operator of the MUJI retail brand, announced on Friday 30 October 2026 that it had detected unauthorised external access to its official MUJI App and that some customer personal information may have leaked externally. The announcement was carried the same day by Kyodo News and Reuters, making it one of the largest customer-data disclosures by a retailer this year by record count.
The company said it blocked access to the affected systems after detecting the intrusion and has implemented corrective measures. It apologised for the concern caused and said it will notify affected customers sequentially, with a further announcement if any external leakage is confirmed in the future.
What data was exposed — and what was not
The scope matters here, because it decides how worried an affected customer should be. The potentially leaked information is limited to three fields, but the record count is very large, and it includes people who have since closed their accounts.
| Detail | What Ryohin Keikaku confirmed |
|---|---|
| Records potentially affected | Up to approximately 27.26 million, including former members |
| Data potentially leaked | Email addresses, dates of birth, gender |
| Data NOT included | Credit card details, names, addresses, phone numbers |
| Confirmed external leakage | None confirmed — no dark-web leakage or misuse damage confirmed so far |
| Company action | Access blocked, corrective measures implemented, customers to be notified in sequence |
Illustrative image: the interior of a MUJI store in Helsinki. The incident affects the MUJI App's customer data, not in-store systems. Image: Wikimedia Commons.
Why it matters for World Tech readers — and what it means for India
A 27-million-record disclosure from a household retail brand is significant even with a narrow data set. Email addresses paired with dates of birth are a standard ingredient for phishing: attackers can craft convincing messages that appear to come from MUJI, a bank or a delivery service, and use the birth date to pass weak identity checks. The risk is not a direct bank-account raid — no payment data was involved — but a higher chance of targeted scam emails landing in inboxes over the coming weeks.
For India, the relevance is indirect but real. MUJI operates stores in India and sells through its Indian online channels, and Indian shoppers who created accounts on MUJI's apps or sites should check which account the disclosure covers: Ryohin Keikaku's notice concerns the official MUJI App it operates, and the company says it will notify affected customers directly. If you hold a MUJI account anywhere, the safe move is to assume your email address could be in scope until the company tells you otherwise, and to watch for phishing rather than waiting for a notification.
Should you care?
✅ Verdict: Yes, if you have ever registered on the MUJI App — even if you closed the account. No card or address data was involved, so this is not a "freeze your cards" incident, but a leaked email plus date of birth is enough for convincing phishing. Change your MUJI password, turn on two-factor authentication where offered, and be sceptical of any email claiming to be about this leak. Nothing to buy, no service to cancel — just a few minutes of account hygiene.
What to do if you are a MUJI App user
1. Change your MUJI App password, and change it anywhere else you reused the same one. 2. Turn on two-factor authentication on your email account first — your inbox is the real target of phishing built on this leak. 3. Do not click links in emails claiming to be about the MUJI leak; go to MUJI's official site or app directly. 4. Watch for messages that quote your date of birth to sound legitimate — that detail may now be in circulation. 5. Wait for Ryohin Keikaku's direct notification, and check the company's official notice rather than forwarded social-media posts.
FAQs
How many MUJI customers are affected by the data leak?
Ryohin Keikaku says up to approximately 27.26 million customer records may have leaked, including information on customers who have since closed their accounts. That is a maximum figure, not a confirmed count of records actually taken.
What MUJI customer data leaked?
Email addresses, dates of birth and gender. The company says credit card details, names, addresses and phone numbers were not included in the potentially leaked data.
Has the leaked MUJI data appeared on the dark web?
No. As of the company's 30 October 2026 announcement, no leakage to the dark web or other channels and no damage from misuse had been confirmed. The company says it will make a further announcement if external leakage is confirmed.
What should MUJI App users do now?
Change your MUJI password, secure your email account with two-factor authentication, ignore links in emails claiming to be about the leak, and wait for Ryohin Keikaku's direct notification to affected customers.
TAKEAWAY: A company-confirmed potential leak of up to 27.26 million MUJI App records — emails, birth dates and gender, no payment data, no confirmed misuse yet. Treat it as a phishing warning, not a payments emergency, and secure your email account first.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
Kyodo News — Muji store operator says up to 27 mil. customer records may have leaked
Reuters via TradingView — Ryohin Keikaku: as many as about 27 million customer records could have been leaked
BigGo Finance — Japan's Ryohin Keikaku reports unauthorised access to MUJI App
Related on TechByCountry: Binance's $6.3 billion security breach, explained, SBI customer data leak: what customers should do now
Comments
Post a Comment