What happened
Ryohin Keikaku, the Japanese company behind MUJI, said on October 30, 2026 that someone got unauthorized access to its official MUJI app and that some customer info may have leaked.
The company says it spotted the access, blocked it and applied a fix. It has not said how the attacker got in or when it started. Up to about 27.26 million records may be affected, including people who already deleted their MUJI app account. The app and the MUJI online store are still working normally.
As of the first announcement, the company said it had not seen the data on the dark web and had not seen it used for fraud.
Update, November 4, 2026: Ryohin Keikaku published a second notice saying the breach is bigger than first reported. Credit Saison, which issues the MUJI Card, says the unauthorized access happened around 1 AM on October 29.
- 01The 27.26 million records also cover MUJI online store members who never used the app, and member IDs are included.
- 02About 520,000 of those records also include name, home address and phone number.
- 03About 1.09 million MUJI Card members who signed up between October 2000 and July 2021 had their full card number, MUJI Card ID and birth date stored on MUJI's system, left over from an old points setup. About 345,000 of those cards are still active. Cardholder name, expiry date and security code were not included.
- 04About 120 people who saved a card in the app or online store had the first 6 and last 2 digits plus the cardholder name exposed.
What data was exposed
Per Ryohin Keikaku, the info that may have leaked is:
- 01Email address, date of birth, gender and member ID (up to 27.26 million records)
- 02Name, home address and phone number (about 520,000 of those)
- 03Full MUJI Card number, MUJI Card ID and birth date (about 1.09 million cards issued Oct 2000 to July 2021, about 345,000 still active)
- 04Partial card number and cardholder name (about 120 saved cards)
What to do now
Security codes, expiry dates and passwords are not listed as exposed. For most people the real risk is phishing that looks like it came from MUJI or Saison. If you got a MUJI Card before August 2021, there is more to do.
- 01MUJI Card from before August 2021? Check your statements and think about a reissue. Credit Saison will reissue the card if you ask. Without the security code a full card number is harder to abuse, but scammers use it to make fake card-security calls and texts sound real.
- 02Be careful with MUJI or Saison emails, texts and calls for a while. Both companies warned about fakes and say they will never ask for your card details by email or phone. Do not tap links in an email about points, coupons or account problems. Open the app yourself.
- 03Do not treat your birthday as a secret. If a bank, phone carrier or other site uses your date of birth as a security check, assume it is known. Add a PIN or a stronger check where you can.
- 04Change your password if you reused it. Passwords are not listed as exposed, but if your MUJI password is the same one you use elsewhere, make them different.
- 05Turn on two-factor on your email account. Your email address is the main thing in this leak, so make that account the hardest one to get into.
How to check if you were in it
Ryohin Keikaku says it will contact affected customers one by one. That message is the most reliable answer. Be careful that the notice itself is not a phishing email: go to MUJI's official site to confirm.
Have I Been Pwned is free and the best known place to check an email against public breaches. This one likely will not appear there unless the data leaks publicly.
OSINT Pro's email lookup checks breach records and stealer logs, which catch passwords stolen by malware on your own device.
OSINT Pro does not have the MUJI dataset. If it ever leaks publicly and gets indexed, we will update this page.
The notice was published in Japanese by Ryohin Keikaku. It does not say whether MUJI apps in other countries are part of this, so if you use MUJI outside Japan, watch for an email from your local MUJI.