Muji Data Breach in Japan: 1.09 Million Credit Card Numbers May Have Leaked — What Customers Should Do
Image: Wikimedia Commons / Dinkun Chen, CC BY-SA 4.0 — a Muji storefront. The breach hit Ryohin Keikaku's MUJI app and online store systems.
📌 KEY HIGHLIGHTS
- 1.09 million credit card records may have leaked — full 16-digit numbers of MUJI Cards issued by July 2021, about 345,000 of them still valid.
- Stored unencrypted: President Satoshi Shimizu admitted the card data "should have been deleted" but was left in the company's database.
- Up to 27.26 million customers may have had app and online-store records exposed — email addresses, birth dates, gender and member IDs.
- Online store suspended since 6 November after a credential-stuffing attack; reopening postponed, with no restart date yet decided.
- No confirmed misuse: the company says it has found no misuse of the data and no dark-web posting so far.
What happened?
Ryohin Keikaku, the Japanese company behind the Muji retail chain, held a press conference in Tokyo on Thursday 12 November 2026, where president Satoshi Shimizu apologised for a cyberattack on the company's systems. The company said it had discovered a security vulnerability that allowed the attack, and that customer data — including more than 1 million credit card records — may have been exposed.
"Card information that should have been deleted had been left" in the company's database, Shimizu said, acknowledging flaws in how customer information was handled. The company said the card numbers had not been encrypted or otherwise properly protected when they were stored, and promised to build a system under which unnecessary information is not kept.
The intrusion was detected at around 01:00 on 29 October, according to card issuer Credit Saison. Ryohin Keikaku first disclosed on 30 October that unauthorised access to its MUJI app may have exposed up to 27.26 million customer records. A second report on 4 November revealed the credit card numbers were involved too. The company's official online store has been suspended since 6 November, along with most MUJI app functions, and the reopening — postponed on 9 November after credential-stuffing attacks were confirmed — has no restart date yet.
What data may have leaked?
The breach covers several groups of customers. The most serious exposure is the MUJI Card data: full 16-digit numbers for cards signed up between October 2000 and July 2021, when the scheme used card numbers to identify customers for reward points. The numbers were passed to Muji by issuer Credit Saison, and stayed in Muji's systems after the scheme switched to other identifiers in 2021.
| Data exposed | How many | Details |
|---|---|---|
| MUJI Card credit card numbers | ~1.09 million | Full 16-digit numbers; ~345,000 still valid; no holder names, expiry dates or security codes included — but ~168,000 sat alongside email addresses and birth dates, and ~25,000 alongside names and addresses |
| MUJI app / online store accounts | Up to 27.26 million | Email addresses, birth dates, gender, member IDs |
| Names, addresses, phone numbers | ~750,000 | App and online-store customers |
| Purchase history and loyalty points | ~270,000 | Exposed through unauthorised logins in the credential-stuffing attack |
| Cash-on-delivery recipients | ~440,000 | Names and postcodes, from orders placed between 2020 and 2025 |
Image: Wikimedia Commons / Nick-D, CC BY-SA 4.0 — inside the Muji store in Ginza, Tokyo.
Why it matters for readers
This is one of the largest retail data breaches of the year, and the detail that should worry every online shopper is not the size alone — it is how the data was kept. Full credit card numbers that should have been destroyed in 2021 were still sitting in a database, unencrypted, five years later. That is a basic data-retention failure, and it is exactly the kind of failure regulators and customers punish hardest.
The attack itself also carries a lesson for anyone who reuses passwords. Part of the incident was a credential-stuffing attack on Muji's online store: attackers tried email addresses and passwords stolen in unrelated breaches, and where customers had reused the same login, they got in. Around 270,000 customers had purchase histories and loyalty points exposed that way. The same technique hits Indian shoppers every day — a password reused across a shopping app, an email account and a bank login is a single point of failure. For context, large-scale breaches keep landing in the same pattern: India's SBI customer data leak and the Unocoin hack both started with credentials and systems that should have been better protected.
What Muji customers should do now
Ryohin Keikaku says it is still investigating whether the potentially leaked information has been misused, and that it has found no misuse and no dark-web posting so far. Individual notifications to affected customers began on 10 November. The company has not said when the online store will reopen, or how the attackers got in — that part of the investigation is still open.
Muji data breach timeline
| Date | What happened |
|---|---|
| 29 Oct 2026 | Unauthorised access detected at around 01:00, according to card issuer Credit Saison |
| 30 Oct 2026 | First disclosure: up to 27.26 million MUJI app records may have leaked |
| 2 Nov 2026 | Ryohin Keikaku tells Credit Saison that card numbers may be involved |
| 4 Nov 2026 | Second report: ~1.09 million MUJI Card credit card records potentially exposed |
| 6 Nov 2026 | Online store suspended; most MUJI app functions stopped |
| 9 Nov 2026 | Reopening postponed after credential-stuffing logins confirmed |
| 10 Nov 2026 | Individual notifications to affected customers begin |
| 12 Nov 2026 | President apologises at a Tokyo press conference; admits card numbers were stored unencrypted and never deleted; reissue fees to be covered |
FAQs
Was my credit card number leaked in the Muji data breach?
Only MUJI Card holders who signed up by July 2021 are in the affected group — about 1.09 million card records, of which around 345,000 cards are still valid. The exposed data was the full 16-digit number, without holder names, expiry dates or security codes. Ryohin Keikaku says it will contact affected customers individually, and it will cover the cost of reissuing affected cards.
Has the leaked Muji data been misused?
Not that anyone has confirmed. The company says it has found no misuse of the data and no posting of it on the dark web so far, and it is still investigating. That can change — card numbers can be traded quietly for months — so affected cardholders should keep watching their statements rather than assuming the risk has passed.
What should I do if I had a MUJI Card?
Check your recent card statements for charges you do not recognise, and ask your card issuer about a replacement card — Muji says it will pay the reissue fee. If you used the same password on the MUJI app or online store as anywhere else, change it everywhere now, and turn on two-factor authentication where it is offered.
Is the Muji online store working again?
No. The official online store has been suspended since 6 November, along with most MUJI app functions, while the company strengthens security. The reopening was postponed on 9 November and the company has not yet decided when it will restart. Physical Muji stores are not affected by the suspension.
Takeaway: A household-name retailer kept 1.09 million full credit card numbers it should have deleted in 2021 — unencrypted — and only admitted it after a cyberattack forced the issue. If you held a MUJI Card, get it replaced; if you reused your Muji password anywhere, change it now.
For a similar lesson closer to home, read our explainer on the TSMC employee data leak, where the breach also came through a third-party supplier rather than the company's own systems.
Sources
- Kyodo News — "Muji operator admits security flaw that may have exposed credit card data" (12 Nov 2026)
- Nippon.com (Jiji Press) — "Muji Operator Fails to Delete Unnecessary Credit Card Data" (12 Nov 2026)
- Japan Cyber Watch — "MUJI Breach: Up to 27 Million Customers, and 1.09 Million Card Numbers Kept From a Perk Scheme That Ended in 2021"
- Chosun Biz — "Muji says 1.09 million credit card numbers may have leaked; president apologizes" (12 Nov 2026)
- TipRanks — "MUJI Online Store Reopening Postponed After Credential-Stuffing Attack" (9 Nov 2026)
Comments
Post a Comment