Muji data breach: full card numbers were kept until 2021

What happened in the Muji data breach?

On October 30, the company said unauthorised access may have hit up to about 27.26 million customer records, including the MUJI app. Credit cards were initially left out. On November 4 it added that the full card numbers of about 1.09 million people who joined the MUJI Card between October 2000 and July 2021 may also have been accessed.

The numbers had been collected to give MUJI Card members special perks. In July 2021 the company changed that system and ended the card number link, but some numbers collected earlier stayed in storage. Asked why, executives said the card number had been used to identify customers until July 2021. The stored numbers were not masked or encrypted.

Why were the numbers not deleted?

The company says it was not intentional and points to flaws in how data was handled. It has not yet worked out whether it was human error or a system problem.

Reporters also asked whether holding the numbers broke the law. Japan's amended Instalment Sales Act, in force since June 2018, generally requires card merchants either not to hold card data or to follow the PCI DSS security standard. Muji said it knew about the no-holding rule at the time but is still checking whether it broke the law.

How did the attackers get in?

The online store saw a flood of login attempts from many IP addresses over a long period. The company calls it a list-based attack, where stolen IDs and passwords from elsewhere are tried repeatedly. The access that reached card data was a different kind of attack.

Muji says it will cover the full reissue fees for affected cards. It denies timing the November 4 announcement to the end of its sale, saying checking the scope took time.