EXPLORINEER
en

JP — ITmedia

Muji's MUJI Card Full Card Numbers, About 1.09 Million Records Possibly Leaked in Unauthorized Access Follow-Up

Security2 min read

Ryohin Keikaku, the company behind the Muji brand, says hackers may have reached more customer data than first reported. This includes full card numbers for about 1.09 million MUJI Card holders.

What happened

Ryohin Keikaku said that people outside the company may have accessed credit card details, names, and addresses from its official app, the MUJI App. The company had first said only some data was affected. The new findings include member data for about 1.09 million MUJI Card holders, with full card numbers. The company is contacting affected people by email or mail.

Key numbers

  • About 1.09 million MUJI Card member records were possibly accessed. These are for people who joined by July 2021.
  • About 345,000 of those cards are still valid. The rest are cancelled or expired.
  • Up to about 27.26 million customer records were affected, as first reported on October 30. About 520,000 of them also include names, addresses, and phone numbers.
  • About 120 people who saved credit card details in the MUJI App or the Muji online store may also be affected. Only the first 6 digits, last 2 digits, and card name were involved.

Why the cards were involved

Before July 2021, MUJI Card members got special perks. To give those perks, the company collected card numbers. That data was still stored in its systems. Credit card company Credit Saison, which issues the MUJI Card, is watching for misuse. Cardholders can ask for a new card.

Why it matters

Full card numbers can be used for fraud, so this leak is serious for the people involved. The company says it has not seen any data posted on the dark web or any misuse so far. Still, customers should check their card statements and contact the card company if they see charges they do not recognize.

What to watch

  • How the company explains the cause and the full reach of the attack.
  • Whether any stolen data appears online or is used for fraud.
  • Whether more customers are added to the list of people affected.
  • Whether Credit Saison issues new cards to affected holders.

Glossary

Ryohin Keikaku
The Japanese company that runs the Muji brand of stores and products.
MUJI Card
A credit card issued by Credit Saison for Muji customers, with member perks.
MUJI App
Muji's official phone app, used for shopping and member services.
Credit Saison
A Japanese company that issues credit cards, including the MUJI Card.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

Security전자신문

Tilon's Dstation X Obtains NIS Security Function Verification Certificate, Clearing Public-Sector Adoption Requirements

VDI company Tilon said its next-generation platform Dstation X (v10.0) has received a security function verification certificate from the National Intelligence Service under its security function testing system. With this, Dstation X has completed quality certification, a procurement channel on the Digital Service Mall, and security verification required for public-sector adoption. Agencies adopting the product can skip the separate security conformity verification process.

SecurityITmedia

Chinese Manufacturer Allegedly Installed Criminal Backdoor on Android Devices Before Shipment; Google Cuts Ties

Google said on November 3 (local time) that more than 1.3 million devices, mainly Android TV set-top boxes, were infected with malware made by Chinese OEM/ODM maker Videostrong Technology, which sold remote access to criminals. Google ended its relationship with the company, barred it from making Google-certified Android devices and supplying software to other certified makers, and disrupted the botnet with law enforcement and security partners, including Japan's National Police Agency.

SecurityITmedia

Denny's App Hit by Unauthorized Access; Fraudulent Credentials Created During Legacy App Migration, Possible Personal Data Leak

Denny's Japan announced on November 3 that its app, which manages coupons and points for its restaurants, was accessed by a third party and that some users' personal data may have leaked. During a system process to migrate from the old app to the new one, unauthorized credentials were created, giving access to some users' accounts; the number of affected people is still under investigation. The company says it does not hold names, addresses, phone numbers, passwords, or credit card information.

Securityheise online

Sabotage of Cooling Systems: Expert Criticizes Manufacturers

After cyberattacks on supermarket refrigeration systems in several European countries, including Germany, IT security expert Christoph Fischer of Karlsruhe places primary responsibility on manufacturers of networked devices, calling the delivery of control systems with unchanged factory settings and default passwords "completely unforgivable." He says manufacturers should configure systems so that individual passwords must be set at first commissioning, and that secure remote access via certificates and asymmetric encryption is technically feasible. Fischer also warned against limiting the problem to grocery retail and urged that verification of IT security be added as a criterion in consumer tests.