MUJI Breach Widens: Full Card Numbers of 1.09M Members at Risk

Ryohin Keikaku explained that before July 2021 it collected card numbers to provide MUJI Card members with its own perks, and that the data had remained in its systems. Credit Saison has stepped up fraud monitoring and will reissue cards for members who request it.

Wider customer data exposure

The earlier figure of up to 27.26 million customer records has also grown in scope. The initial notice covered email addresses, birth dates and gender of app users. Further investigation showed that online store members who never used the app are also affected, and that member IDs were exposed too. Around 520,000 of the 27.26 million records also include names, addresses and phone numbers.

Separately, about 120 users who had registered card details in the app or the MUJI online store may have had their data accessed. That data consists of the first six and last two digits of the card number, plus the cardholder name.

What users should do

The company will contact affected people by email or post. It urges customers to check card statements and to contact their card issuer about any charges they do not recognize. So far, it has not confirmed any leak to the dark web or any damage from misuse. The MUJI app and online store remain available as usual, and the investigation into the cause and scope continues.