Science & Tech · Cybersecurity · 2 hrs ago
Muji operator says retained credit card data may have leaked
Muji operator Ryohin Keikaku said credit card data may have leaked after a cyberattack.
The company said some card information that should have been deleted may have been exposed, but it is unclear whether keeping the data was intentional.
An earlier investigation found that up to 27.26 million customer records may have been exposed through unauthorized access to the MUJI app.
The company also said full card numbers and information on about 440,000 cash-on-delivery customers may have leaked.
About 1.09 million credit card records may be involved, though the company has not confirmed how many were affected.
President Satoshi Shimizu apologized, and the company plans to cover card replacement fees for customers whose cards may be affected.
Ryohin Keikaku is investigating and strengthening security, while most services remain suspended apart from its official online store and some app functions.
Ryohin Keikaku, the operator of Muji, said some credit card information that should have been deleted may have leaked.
The company said the potential breach may involve about 1.09 million credit card records.
A further investigation found that full credit card numbers and data on about 440,000 customers with cash-on-delivery orders may also have been exposed.
The company said it remains unclear whether retaining the data was intentional.
President Satoshi Shimizu apologized and said the company plans to cover card reissuance fees for cards that may have been affected.
- Who
- Ryohin Keikaku Co., the operator of Muji.
- What
- The company said credit card information that should have been deleted may have leaked.
- When
- Thursday, Nov. 12, 2026. The company had announced unauthorized access on Oct. 30.
- Where
- Tokyo, where the company held a press conference; the unauthorized access involved the MUJI app.
- Why
- A cyberattack and unauthorized access may have exposed data. The reason the credit card data was retained is unclear.
This story does not have two clearly opposing sides.
Ryohin Keikaku said unauthorized access to its MUJI app may have exposed up to 27.26 million customer records.
The company said further investigation found that credit card information that should have been deleted may have leaked.
- Potential card records
- About 1.09 million
- Cash-on-delivery customers
- About 440,000
- Potentially exposed customer records
- Up to 27.26 million
- Company president
- Satoshi Shimizu
- Press conference location
- Tokyo