Short answer
Ryohin Keikaku, the company behind MUJI, said on 30 October 2026 that it detected unauthorized external access to the MUJI app and that up to about 27.26 million customer records may have leaked. A second report on 4 November, as covered by Impress Watch, added up to about 1.09 million MUJI Card numbers kept from past point programs.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Ryohin Keikaku (MUJI) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Retail |
| Country | Japan |
| Disclosed | 2026-10-30 |
| People or records affected | Up to about 27.26 million MUJI app and Net Store records, plus up to about 1.09 million MUJI Card numbers |
What data was exposed
- Email address, date of birth, gender and member ID for up to about 27.26 million records, including former members
- Name, address and phone number for about 520,000 of those records
- Full card numbers and card IDs, with dates of birth, for up to about 1.09 million MUJI Card members who joined by July 2021 (about 345,000 still valid)
- First 6 and last 2 digits of card numbers plus cardholder names for up to about 120 users who registered a card in the app or Net Store
What happened
Ryohin Keikaku, which operates MUJI, announced on 30 October 2026 that it had detected unauthorized access from outside to the MUJI app. According to ScanNetSecurity, the company blocked the access point, applied a fix and said up to about 27.26 million customer records might have leaked. That figure includes customers who had withdrawn their membership. The first notice said the data was email addresses, dates of birth and genders, and that no credit card data was involved.
The second report
On 4 November the company issued a further report, which Impress Watch summarized on 6 November. It split the exposure into three groups.
The first group is MUJI app and MUJI Net Store users, including former members: up to about 27.26 million records with email address, date of birth, gender and member ID. About 520,000 of these also include name, address and phone number.
The second group is MUJI Card members who joined by July 2021. Up to about 1.09 million records could include the full card number, the MUJI Card ID and the date of birth. About 345,000 of those cards were still valid when the report was made. Cardholder name, expiration date and security code were not included.
The third group is small: up to about 120 people who registered their card in the app or Net Store. For them the first 6 and last 2 digits of the card number and the cardholder name could be viewed, along with the contact details from the first group.
Why card numbers were there
Impress Watch says Credit Saison, the card issuer, sent card information to MUJI between October 2000 and July 2021 so that MUJI could grant points to cardholders. MUJI has changed the points system and no longer receives card numbers. Credit Saison said it is strengthening fraud monitoring and will reissue cards to anyone who asks.
What is still open
The sources we read do not say how the attacker got in, how long the access lasted, or whether passwords were involved. We found no public claim by an attacker. The company said it would contact affected people in sequence and strengthen monitoring with its development and affiliated companies.
A leaked birth date and member ID make a fake message look more believable, which is why this kind of data is useful to scammers even without a password. Our data breach checklist covers the first steps, and the pattern of fake card alerts is described in our guide to phishing messages. Other Japanese incidents from the same weeks are listed on the breaches index, including Lawson and Sony.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails or SMS posing as MUJI, Credit Saison or a card company asking you to confirm card details or a reissue.
- Targeted messages that quote your date of birth or member ID to sound legitimate.
- Calls claiming your MUJI Card was misused and asking for a PIN or a one-time SMS code.
- Fake card reissue offers that send you to a lookalike site.
What to do if you are affected
- 01If you held a MUJI Card before August 2021, check recent card statements and report charges you do not recognize to Credit Saison.
- 02Consider requesting a reissued MUJI Card, which Credit Saison says it will provide on request.
- 03Do not open links in messages about this incident. Go to the MUJI app or the company site yourself.
- 04Change your MUJI password and any account where you reused it, and turn on two-step verification where offered.
Frequently asked questions
How many MUJI customers were affected?
Ryohin Keikaku said up to about 27.26 million records, including people who had already left the membership, according to ScanNetSecurity and Impress Watch. The figure is an upper bound.
Were credit card numbers exposed?
The first report on 30 October said no credit card data was involved. The 4 November report, per Impress Watch, added up to about 1.09 million MUJI Card numbers, without the expiration date, security code or cardholder name.
Why did MUJI hold card numbers?
Impress Watch reports that Credit Saison sent card information to MUJI from October 2000 to July 2021 so points could be awarded. MUJI has since changed the system and no longer receives card numbers.
Is my newer MUJI Card affected?
According to the company's report as relayed by Impress Watch, people who received a MUJI Card from August 2021 onward are not affected by the card number exposure.
Sources
- 「MUJI Card」のカード番号約109万件の流出可能性も判明 (Up to 1.09 million MUJI Card numbers may also have leaked), Impress Watch, 2026-11-06
- 「MUJIアプリ」最大約2,726万件の顧客情報が流出した可能性 (MUJI app: up to about 27.26 million customer records may have leaked), ScanNetSecurity, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.