Teollimi

Muji (Ryohin Keikaku) data breach

Was I affected?

Muji (Ryohin Keikaku) confirmed a breach affecting about 27.3 million people, exposing email addresses, dates of birth, names and addresses. You may be affected if you have (or had) a MUJI app or Muji online store account in Japan, or a MUJI Card issued by Credit Saison that you signed up for before August 2021.

Muji (Ryohin Keikaku) breach facts
AnnouncedOct 30, 2026
When it happenedFrom October 29, 2026
CountryJapan
People affected27.3 million
Data exposedEmail addresses, Dates of birth, Names, Addresses, Phone numbers, Payment card numbers and Other details
StatusConfirmed by the company or a regulator filing

What happened

Ryohin Keikaku, the company behind Muji, said on October 30, 2026 that outsiders accessed the MUJI app system, exposing up to 27.26 million app and online store accounts (email addresses, dates of birth, gender, member IDs), about 520,000 of which also included names, addresses and phone numbers. In a November 4 update it said full card numbers and dates of birth for about 1.09 million MUJI Card members who joined between October 2000 and July 2021 may also have been accessed; about 345,000 of those cards are still active. Names, expiry dates and security codes on the card records were not included, and the card issuer Credit Saison says it has not seen a rise in fraud.

What should I do?

  1. If you have a MUJI Card opened before August 2021, request a free replacement with a new number through Saison's Net Answer or Saison Portal.
  2. Check your card statements for charges you don't recognize and report them to Credit Saison.
  3. Treat emails, texts and calls that mention Muji, the MUJI app or MUJI Card as suspect, and don't enter card numbers or PINs from links in them.
  4. Expect phishing aimed at the email address you used for the MUJI app; go to the app or muji.com directly instead of following links.
XRedditWhatsApp

More data breaches in Japan →

Check the other services you use →

Sources