Ryohin Keikaku says breach may have exposed 1.09 million MUJI card records

Ryohin Keikaku Co. and Credit Saison said that information for about 1.09 million MUJI Card holders, including full card numbers, may have been affected by a third party’s unauthorized access, after the operator’s discovery of the official MUJI App breach at roughly 1 a.m. on Oct. 29, with disclosure on Oct. 30.

Of the affected cards, about 345,000 remain active and usable, while roughly 745,000 expired or were canceled. The exposed card data covers members who joined between October 2000 and July 2021, and it includes full card numbers, MUJI Card IDs and birth dates. Cards issued from August 2021 onward fall outside the scope of the incident, and the affected card data contained no cardholder names, expiration dates or security codes.

The exposed personal data included names, addresses, phone numbers, genders and e-mail addresses for some members, and the affected data also includes member IDs. About 520,000 affected records include names, addresses and phone numbers. Roughly 120 users who signed up with the app or online store using card details may have had partial card numbers and cardholder names accessed, though full card numbers, expiration dates and security codes were not exposed for them.

The operator’s further investigation indicated the breach may also have exposed full card numbers and details tied to about 440,000 cash-on-delivery customers. The expanded disclosure also reaches former members and online store members who are not app users.

Credit Saison provided card numbers to Ryohin Keikaku, allowing the retailer to grant benefits to MUJI Card users. With the points system changed, card numbers do not link to it anymore, but Ryohin Keikaku’s systems still contain earlier information.

The company identified reward customers using full card numbers from its MUJI Card credit cards until July 2021, then switched to other information. The company kept the data despite a policy calling for deletion of full credit card numbers, and it continues investigating without determining whether retaining the data was intentional.

Initially, the company said the figure could reach about 27.26 million app users whose email addresses and birth dates may have leaked, with no credit card information involved. The Oct. 30 disclosure said the company’s MUJI app faced unauthorized access that potentially exposed up to 27.26 million customer records. A later investigation found that card information was affected as well, and the company informed Credit Saison on Nov. 2.

Credit Saison said it found no evidence that anyone accessed its systems without authorization or that any leak started there. On Nov. 4, the company said no confirmed exposure of customer data had appeared on the dark web or another site, and no confirmed damage from misuse had occurred. The company has not disclosed how the attackers got past security.

The operator said it stopped the unauthorized access and stepped up system monitoring. Credit Saison has increased monitoring for fraudulent use of MUJI Cards without confirming increased unauthorized use. Ryohin Keikaku Co., Ltd. postponed the planned reopening of the MUJI Online Store, which the operator has suspended since November 6, 2026.

While strengthening security, the operator suspended most services and kept only some app functions available. The operator postponed the planned reopening of the MUJI Online Store, which has been suspended since November 6, 2026.

The operator said the Online Store cannot reopen until more comprehensive security upgrades are in place, and it will announce a new reopening date only after the operator puts countermeasures in place and finishes verification steps. Every customer must reset a password when the Online Store reopens. Operations can resume once security enhancements are in place and it confirms customers can use the service with confidence. It will announce the reopening date once it makes a decision.

At a Tokyo press conference, Ryohin Keikaku President Satoshi Shimizu apologized over a cyber attack that may have exposed credit card records. The company said it will cover reissuance fees, applying to credit cards potentially affected by the breach.

Members may request reissued cards, with delivery taking time, through Credit Saison’s Net Answer or Saison Portal services. The two companies will contact affected members in sequence by email or mail. Members should review their card statements, and they should report unrecognized charges to Credit Saison. Warnings went out about suspicious e-mails, texts and calls that pretend to come from the companies; the operator said it never asks for credit card information by email or phone.