Muji Delays Online Store Reopening After Credential Stuffing Attack

Revised figures

The company also corrected earlier numbers. Of the up to 27.26 million records previously flagged, those containing names, addresses and phone numbers were revised from roughly 520,000 to roughly 750,000. A further possible leak came to light as well: about 440,000 delivery recipients for cash-on-delivery orders placed at Muji stores and the online store between January 2, 2020 and February 10, 2025 may also have been exposed.

What users should do

The reopening date will be announced after the necessary measures and checks are complete. When the store returns, the company is preparing to require all users to reset their passwords, and it urges customers to choose a password different from those used on other services.

The incident began on October 30, when the company said unauthorized access to the MUJI app may have exposed up to 27.26 million member records. A second report on November 4 widened the scope to include MUJI Card numbers. On November 6 at 4 p.m., the online store was suspended for further security hardening, and the app was limited to showing the membership barcode.