Muji App Data Leak May Affect Up to 27.26 Million Users

Ryohin Keikaku, the company behind the Muji retail brand, announced on October 30 that some user information from its official MUJI app may have been exposed. The company puts the number of affected records at up to roughly 27.26 million.

What was exposed

Three types of data may have leaked: email addresses, dates of birth and gender. According to the company, credit card information, names, addresses and phone numbers are not included. The total also covers people who have already closed their accounts.

Ryohin Keikaku says it detected unauthorized access from outside, blocked access to the affected part of its systems and applied a fix. As of now, it has not confirmed that any user data has appeared on the dark web or other channels, nor any damage caused by misuse of the information.

What users should do

The company plans to contact users whose data may have been compromised, one after another. It also warns that the leaked email addresses could be used for spoofed emails that impersonate the brand or others, and urges users to stay alert to suspicious messages.

Because the exposed data includes email addresses paired with birth dates and gender, phishing attempts that appear personalized are a realistic risk, even though no financial details were involved.

The MUJI app and the Muji online store are currently working normally. Ryohin Keikaku says it will work with its development partner and affiliated companies to strengthen security measures and monitoring. The company has not said when notifications to affected users will be completed.