Muji Operator Ryohin Keikaku Warns of Up to 27.26M App Records Leaked

Ryohin Keikaku, the Tokyo-based operator of the Muji retail brand, announced on October 30 that customer data from its MUJI app may have leaked, affecting up to roughly 27.26 million records. The company said the data also covers users who have already deleted their accounts.

The announcement came during "Muji Week", the company's sales event for members.

What was exposed

Three data items may have been compromised: email addresses, dates of birth and gender. According to the company, credit card details, names, addresses and phone numbers are not included.

Ryohin Keikaku said that after detecting the unauthorized access from outside, it blocked access to the affected area and applied a fix. So far, it has not confirmed any leak to the dark web or any damage caused by misuse of the data.

What users should do

The company plans to contact affected users in sequence. If an actual leak to outside parties is confirmed, it says it will make a further announcement. Because the exposed information could be used for spoofed emails, it urged users to be cautious about messages that appear to come from Muji or other trusted senders.

The MUJI app and the company's official online store, the Muji Net Store, remain available as usual.

The incident adds to a string of unauthorized-access cases at Japanese companies in recent months. Even without payment data, a combination of email address, birth date and gender can make phishing messages more convincing, which is why the warning about impersonation emails matters for the millions of people on the list, including former members.