MUJI breach update adds 1.09 million card numbers

Ryohin Keikaku reverses its first notice on card data

Ryohin Keikaku's first notice on October 30 said only email addresses, birth dates and gender may have leaked, with no card details. In its second notice on November 4, Ryohin Keikaku said full card numbers for about 1.09 million MUJI Card members may also have been accessed. The company says further investigation turned up the new facts.

Ryohin Keikaku is the Tokyo company that runs the MUJI brand of household goods, clothing and food, and the MUJI Card is a credit card issued with Credit Saison. Japanese companies disclosed a string of leaks in October. Japan data breach list: cases by date and cause sets out earlier cases with their record counts and causes.

Three groups of customers are now in scope

The second notice splits the people affected into three groups: app and online store members, MUJI Card members, and customers who saved a card. The "Data that may have been accessed" table below sets out each group.

Data that may have been accessed, per Ryohin Keikaku's November 4 notice

Group	Data	Records
MUJI app and online store members, including former members	Email address, date of birth, gender, member ID	Up to about 27.26 million
Some of the members above	The data above plus name, address and phone number	About 520,000
MUJI Card members who joined by July 2021	Full card number, MUJI Card ID, date of birth	About 1.09 million
Customers who saved a card in the app or online store	First six and last two digits of the card number, cardholder name	About 120

The MUJI Card records do not include the cardholder name, expiry date or security code, and the 120 saved cards do not include the expiry date or security code either. Without those, a card number alone is not enough for most online purchases.

Ryohin Keikaku adds that about 168,000 of the roughly 345,000 still-valid MUJI Cards could be viewed alongside member data such as email addresses in its internal systems. For about 25,000 of those, the card number sat alongside a name, address and phone number as well.

Online store shoppers and former members are counted too

The first notice described the 27.26 million records as MUJI app data. The second notice says the 27.26 million figure also covers online store members who never used the MUJI app, and adds member IDs to the data in scope. People who only shop on the MUJI online store may therefore be in the count, as may people who deleted their account.

The figure is the maximum number of records that may have been accessed, not a confirmed count of people. Ryohin Keikaku calls the 520,000 figure a count "as of now," so it may change as the investigation goes on.

Why Ryohin Keikaku still held card numbers

The MUJI Card is issued by Credit Saison, not by Ryohin Keikaku. Credit Saison passed the numbers to Ryohin Keikaku from October 2000 to July 2021 for a points perk, and Ryohin Keikaku says they stayed in its systems.

Ryohin Keikaku says it collected the card numbers, MUJI Card IDs and birth dates to give MUJI Card members its own perks. Credit Saison later changed how points are given and no longer shares card numbers.

Of the 1.09 million cards, about 345,000 are still valid. The other 745,000 or so have been cancelled or have expired. Cards issued from August 2021 onward are not affected.

What Ryohin Keikaku has and has not disclosed

Ryohin Keikaku has issued three notices in a week. It has blocked the access and tightened monitoring of its other systems. Even so, the cause and full scope are still under investigation.

The company says it will announce anything new promptly. Each notice so far has widened either the data in scope or the steps the company is taking.

MUJI app reduced to a membership barcode

At the time of the second notice, the company said the MUJI app and online store were working normally. Then on November 6, Ryohin Keikaku paused the online store and cut the MUJI app back to the membership barcode. It called this its third notice and gave the protection of customer data as the reason.

• MUJI online store: all services and features paused
• MUJI app: everything except the MUJI Members barcode paused

The company aimed to reopen within one to two days, but on November 8 the online store still showed a suspension page. (Update, November 9, 2026: Ryohin Keikaku published a fourth notice reporting possible unauthorized logins to about 270,000 accounts through a credential-list attack on the online store, and postponed the reopening. It is preparing to ask all users to reset their passwords when the store returns.) MUJI shops in Japan are open as usual.

No misuse or dark web listing found so far

Both Ryohin Keikaku notices also report whether the data has turned up anywhere. As of the second notice, neither a dark web listing nor any misuse of the data had been found. Credit Saison says it has seen no rise in fraudulent MUJI Card use.

The dark web is a part of the internet that ordinary search engines do not index and that needs special software to reach. Stolen personal data is often traded there, so whether a leaked dataset turns up for sale is one of the first signs that it is being used.

Entry point and cause are still not public

Ryohin Keikaku's own notices give no time for the intrusion. Credit Saison dates the intrusion to about 1 a.m. on October 29, but neither notice says how the attackers got in or why.

Credit Saison also says Ryohin Keikaku told it on November 2 that card numbers may have been involved. It adds that its own systems were not breached and that no data leaked from them.

Steps for affected MUJI customers

Affected customers will hear from Ryohin Keikaku or Credit Saison in the coming weeks. So Ryohin Keikaku asks affected customers to check their card statements and to watch for emails and calls pretending to be from the company or a card issuer. An impersonation email copies the name and look of a real company to get the reader to click a link, sign in on a fake page or hand over card details.

Ryohin Keikaku says it will never ask for card details by email or phone. Any message that does is fake.

Check statements and contact Credit Saison

Credit Saison, which issues the MUJI Card, is watching closely for fraudulent use and will reissue cards on request. Unfamiliar charges should also go to Credit Saison.

• New card: request through Credit Saison's Net Answer or Saison Portal services
• Phone: 0120-227-190 (toll-free within Japan)
• Hours: 10:00 to 17:00 Japan time, every day until December 26, then Monday to Saturday from January 4, 2027

Members can check when they joined under "Customer information" in Net Answer or Saison Portal. A reissued card takes some time to arrive.

Do not click links or enter personal details

Because Ryohin Keikaku will contact affected customers by email or post, real notices and fake ones may arrive in the same weeks. Credit Saison will contact MUJI Card members whose details Ryohin Keikaku does not have. The safe habit is not to click links in these messages and not to type in personal details.

If a message about your MUJI account or card arrives, open the MUJI app already on your phone, or the official site you have bookmarked, and check there. If you are still unsure, call one of the numbers given here rather than any number printed in the message.

Calling Ryohin Keikaku's customer service line

The customer service line is 0120-64-0772, open every day from 9:30 to 17:00 Japan time until December 26. It is the contact Ryohin Keikaku gives in its second notice.

• Contact: Ryohin Keikaku customer service
• Phone: 0120-64-0772 (toll-free within Japan)
• Hours: 9:30 to 17:00, every day until December 26, then Monday to Saturday from January 4, 2027

The notices give no separate contact for customers outside Japan, so people who use MUJI in other countries may want to check with the MUJI company where they live. Questions about online store orders go to a separate order inquiry page.

What companies and individuals should check now

Japan's regulators ask companies to delete data they no longer need and ask consumers to sign in only through bookmarks or official apps. In the MUJI case, card numbers stayed in Ryohin Keikaku's systems after the sharing arrangement ended in July 2021, and about 745,000 of them belong to cards that no longer work. Former members' data is in scope as well.

Two Japanese agencies issued alerts in October as reports of leaks piled up, one for businesses and one for consumers. Japan's privacy regulator counted data on a cumulative 260 million people in reports from April to mid-October, as covered in Japan's data leaks hit 260 million since April.

Companies: delete personal data you no longer need

Japan's privacy regulator found on October 7 that data kept after it stops being needed has made leaks worse, and pointed businesses to Article 22. The regulator is the Personal Information Protection Commission, and Article 22 of Japan's privacy law requires businesses to make an effort to delete personal data without delay once they no longer need it.

Neither notice explains why the card numbers were kept after 2021, and nothing in them shows that Ryohin Keikaku broke this rule. For any company that receives customer data from a partner, though, the case is a prompt to check whether data from finished arrangements and closed accounts is still stored, and whether there is a stated reason to keep each record.

Individuals: open MUJI through a bookmark or the app

Japan's Consumer Affairs Agency advises treating emails from businesses as possible phishing and going through a bookmarked site or official app instead. Phishing is a scam that uses emails or text messages pretending to come from a real company to lure people to a fake site and steal IDs, passwords or card numbers.

For a shop you use often, such as the MUJI online store once it reopens, a saved bookmark or the official app removes the need to tap links in emails at all. A strong password that is not reused on other sites, plus multi-factor authentication where a service offers it, keeps a leaked password from opening other accounts. In Japan, the consumer hotline 188 takes calls from people who are worried about a leak.