Muji Said No Card Data Leaked, Then Admitted Hackers May Have Reached 1.09 Million Card Numbers It Kept

Muji's first breach notice said card details, names and addresses were not involved. Five days later, all three were on the list. The most dangerous part of the haul, about 1.09 million full credit card numbers, came from a loyalty perk Muji stopped using in 2021 and never cleaned up.

From "not included" to a million cards

Someone got into the systems of Ryohin Keikaku, the company behind Muji, around 1 a.m. on October 29, according to card issuer Credit Saison. Muji spotted the access, blocked it and applied a fix.

Its first report, on October 30, said email addresses, birth dates and gender for up to 27.26 million Muji app users, former members included, may have leaked. Card information, names, addresses and phone numbers were not, it said.

That held for three days. On November 2, Muji told Credit Saison that card numbers it had once received were also in the data that may have been accessed. Its second report on November 4 widened the picture: the 27.26 million figure also covers online store customers, and about 520,000 records may include names, addresses and phone numbers.

Then the cards. Hackers may have reached the full numbers of about 1.09 million Muji Card credit cards, stored alongside Muji Card IDs and birth dates. About 345,000 are still valid; the other 745,000 or so have expired or been cancelled. No holder names, expiry dates or security codes were included. Separately, about 120 customers who saved a card in the app had the first six and last two digits viewable, along with the holder's name.

For about 168,000 of the valid cards, the numbers sat next to the holders' email addresses, birth dates and gender. For about 25,000, they also sat next to a name, address and phone number.

A perk that outlived itself

The numbers were there because of a points program. From October 2000 to July 2021, Credit Saison passed Muji Card numbers and birth dates to Ryohin Keikaku so Muji could reward card spending with points. The scheme changed in 2021 and Saison stopped sending the numbers. Cards issued from August 2021 are not affected.

The old data simply stayed. Ryohin Keikaku says only that it "remained" in its systems. Five years after the perk ended, it became the worst part of the breach. Muji has not said how the attackers got in.

The company says its app and online store are working normally, it has found no sign of the data posted on the dark web and no misuse, and it will contact affected customers. Credit Saison has stepped up monitoring and will reissue cards on request. Ryohin Keikaku expects a limited hit to its results.

It is not Muji's only problem. On November 2 it disclosed a separate incident: a server at Nanotech, a system company used by its made-to-order curtain contractor MN Inter-Fashion, was accessed on October 19, possibly exposing names, addresses, phone numbers and order details from 19,933 curtain orders placed between April 2018 and January 2022.

A bad autumn for Japanese brands

Muji joins a growing list. Last month Sony disclosed that an intruder got into its So-net member database four days before the company confirmed the breach, and about 2.6 million customer records leaked.

The same week as Muji's update, Nomura Investor Relations said its Institutional Navi service for investors and analysts had been breached, possibly exposing names and emails, and suspended it. Bic Camera said about 14.9 million customer records, including email addresses, may have leaked through Arara Inc., the contractor that runs its email newsletter system. The Arara breach also hit airlines Airdo, with 673,920 email records, and Solaseed Air, with up to 490,000, plus workwear maker Workman, with up to 1.45 million.

Some offers on this page may be paid placements or contain affiliate links.