Muji breach: up to 27.26 million customer records and 1.09 million full MUJI Card numbers may have leaked ยท updates https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026 Ryohin Keikaku, the company behind Muji, says unauthorized access to its systems on Oct 29 2026 may have exposed up to about 27.26 million MUJI app and Muji online store customer records (email addresses, birth dates, gender and member IDs, including former members), about 520,000 of them with names, addresses and phone numbers. Its Nov 4 follow-up adds about 1.09 million MUJI Card records holding full card numbers, birth dates and MUJI Card IDs, which the company had kept from a pre-2021 points scheme; about 345,000 of those cards are still valid. Cardholder names, expiry dates and security codes were not included. Card issuer Credit Saison has seen no rise in fraud, is monitoring the cards and reissues them on request. Ryohin Keikaku says it blocked the access and has found no sign of the data on the dark web so far. en Wed, 04 Nov 2026 00:00:00 GMT Muji breach: up to 27.26 million customer records and 1.09 million full MUJI Card numbers may have leaked: Second report widens the breach: the 27.26 million records also cover Muji online store members and include member IDs, about 520,000 of them with names, addresses and phone numbers. About 1.09 million MUJI Card records with full card numbers, MUJI Card IDs and birth dates (about 345,000 cards still valid) were also accessible, plus about 120 saved cards (first 6 and last 2 digits and cardholder name). Credit Saison is monitoring for fraud and reissues cards on request. https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026 https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026#2026-11-04-10a08564 Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://www.ryohin-keikaku.jp/news/articles/2026_1104_02">Source</a></p> Muji breach: up to 27.26 million customer records and 1.09 million full MUJI Card numbers may have leaked: Ryohin Keikaku discloses that up to about 27.26 million MUJI app customer records (email addresses, birth dates and gender, including former members) may have leaked. It says it blocked the access and applied a fix, and that card data, names, addresses and phone numbers were not involved. https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026 https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026#2026-10-30-5af114a5 Fri, 30 Oct 2026 00:00:00 GMT high <p><a href="https://www.ryohin-keikaku.jp/news/articles/2026_1030_01">Source</a></p> Muji breach: up to 27.26 million customer records and 1.09 million full MUJI Card numbers may have leaked: A third party gains unauthorized access to Ryohin Keikaku's (Muji's) systems at about 1:00 a.m. Japan time, according to MUJI Card issuer Credit Saison. https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026 https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026#2026-10-29-f02e545f Thu, 29 Oct 2026 00:00:00 GMT high <p><a href="https://www.saisoncard.co.jp/customer-support/information/20261104/">Source</a></p>