EXPLORINEER
en

JP — ITmedia

Muji operator may have leaked up to 27.26 million member records in unauthorized access, including former members

Security2 min read

Ryohin Keikaku, the company behind Muji stores, says customer data from its MUJI app may have leaked. The possible leak could include up to about 27.26 million records, including data from users who already left the service.

What happened

Ryohin Keikaku said on October 30 that customer information from its MUJI app may have leaked. The company found an outside attack trying to get into its system. It blocked access to the affected part and applied a fix. Ryohin Keikaku also said the data may include people who had already closed their accounts.

Key numbers and facts

  • Up to about 27.26 million (2,726 万) records may have leaked.
  • Possibly leaked items: email address, date of birth, and gender.
  • Credit card details, name, address, and phone number are not included, the company says.
  • No leak to the dark web or misuse of the data has been confirmed so far.

Some context

The MUJI app lets members shop and get member sales. The MUJI online store, called Muji Netstore, still works as normal. The news came out during a members-only sale called Muji Week.

Why it matters

This is a very large number of people. Even though the leaked items are less sensitive than card numbers, email addresses and birth dates can still be used in scam emails. Users should be careful about messages that look like they come from Muji.

What to watch

  • Ryohin Keikaku will contact affected people one by one.
  • The company will announce again if it confirms that the data was actually taken out.
  • Users should watch for fake emails that use the leaked information.

Glossary

Ryohin Keikaku
The company that runs the Muji brand and its stores and online shops.
MUJI app
The official Muji phone app where members shop and get member benefits.
Muji Netstore
Muji's official online shop for buying products over the internet.

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityITmedia

Report: Japan's MIC asks telecom carriers to block GMO attacker sites

According to reports from Asahi, Yomiuri, Nikkei and others on October 29, the Ministry of Internal Affairs and Communications asked telecom providers to forcibly block access to attacker-run websites that posted personal information allegedly belonging to GMO Internet customers. The request, dated October 27, was relayed to carriers through four telecom industry groups, and carriers have not disclosed whether they carried out any blocking. GMO said on October 28 that it had confirmed the domains of the attacker sites, including mirror sites, were shut down.

SecurityITmedia

Matsuya App Hit by Unauthorized Access, About 2.38 Million Personal Records Leaked; Compensation Planned During Suspension

Matsuya Foods Holdings announced on October 30, 2026 that unauthorized access to its official app's management system led to the leak of about 2.38 million personal records. The leaked data includes member IDs, names, phone numbers, and Matsuya Point information, along with delivery addresses for users of its bento reservation and delivery services. The company plans to compensate app members for the service suspension period, and the cause of the intrusion is still under investigation.

SecurityITmedia

Yakult Honsha Confirms Leak of About 40,000 Personal Records After Unauthorized Access to Official Website

Yakult Honsha announced on October 30 that its website was accessed by a third party without authorization, leading to the leak of personal information for about 40,000 people, including users of its inquiry forms. Leaked data includes names, contact details and inquiry content, as well as member information for its "Tanoshii Kyushoku" program, while the company says it does not hold customer credit card or bank account details. The website was taken offline on October 26 and remained under maintenance as of October 30, and the company has reported the incident to the Personal Information Protection Commission and consulted police.