Muji Online Store Reopening Delayed After Credential Attack

Reused passwords at the heart of the attack

The attackers used passwords and similar credentials that may have been obtained illegally elsewhere. Muji had strengthened monitoring after its first report on October 30, but further unauthorized access convinced it that a comprehensive review of its security measures was needed before restarting.

When the store returns, the company plans to require all users to reset their passwords. It also urges customers who use the same email address and password across several services to choose a password that differs from those used elsewhere, since reuse raises the risk of unauthorized logins.

Cash-on-delivery data also affected

Muji also confirmed unauthorized access to some information on users who were recipients of cash-on-delivery shipments through its stores and online store between January 2, 2020 and February 10, 2025. The number of affected users announced so far has been partly revised.

From November 10, Ryohin Keikaku and Credit Saison will begin contacting affected users in turn by email or post. For cash-on-delivery users whose contact details Ryohin Keikaku does not hold, the November 9 announcement itself replaces individual notification.

For customers, the practical step is to avoid reusing Muji passwords elsewhere and to expect a mandatory reset once the store is back online.