# Muji breach: up to 27.26 million customer records and 1.09 million full MUJI Card numbers may have leaked · pwn.watch > Ryohin Keikaku, the company behind Muji, says unauthorized access to its systems on Oct 29 2026 may have exposed up to about 27.26 million MUJI app and Muji online store customer records (email addresses, birth dates, gender and member IDs, including former members), about 520,000 of them with names, addresses and phone numbers. Its Nov 4 follow-up adds about 1.09 million MUJI Card records holding full card numbers, birth dates and MUJI Card IDs, which the company had kept from a pre-2021 points scheme; about 345,000 of those cards are still valid. Cardholder names, expiry dates and security codes were not included. Card issuer Credit Saison has seen no rise in fraud, is monitoring the cards and reissues them on request. Ryohin Keikaku says it blocked the access and has found no sign of the data on the dark web so far. Page: https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026 · generated 2026-11-05T02:38:25.671Z ## Status - Severity: high · status: live · patch: partial - Product: MUJI app, Muji online store and MUJI Card data (Ryohin Keikaku) - Started: 2026-10-29 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026.json - This file: https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026/llms.txt ## Updates (newest first) - 2026-11-04: Second report widens the breach: the 27.26 million records also cover Muji online store members and include member IDs, about 520,000 of them with names, addresses and phone numbers. About 1.09 million MUJI Card records with full card numbers, MUJI Card IDs and birth dates (about 345,000 cards still valid) were also accessible, plus about 120 saved cards (first 6 and last 2 digits and cardholder name). Credit Saison is monitoring for fraud and reissues cards on request. (https://www.ryohin-keikaku.jp/news/articles/2026_1104_02) - 2026-10-30: Ryohin Keikaku discloses that up to about 27.26 million MUJI app customer records (email addresses, birth dates and gender, including former members) may have leaked. It says it blocked the access and applied a fix, and that card data, names, addresses and phone numbers were not involved. (https://www.ryohin-keikaku.jp/news/articles/2026_1030_01) - 2026-10-29: A third party gains unauthorized access to Ryohin Keikaku's (Muji's) systems at about 1:00 a.m. Japan time, according to MUJI Card issuer Credit Saison. (https://www.saisoncard.co.jp/customer-support/information/20261104/) ## Fix brief # Security brief: Muji breach: up to 27.26 million customer records and 1.09 million full MUJI Card numbers may have leaked Source: https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026 · status: live · severity: high · updated Nov 5, 2026, 01:28 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Ryohin Keikaku, the company behind Muji, says unauthorized access to its systems on Oct 29 2026 may have exposed up to about 27.26 million MUJI app and Muji online store customer records (email addresses, birth dates, gender and member IDs, including former members), about 520,000 of them with names, addresses and phone numbers. Its Nov 4 follow-up adds about 1.09 million MUJI Card records holding full card numbers, birth dates and MUJI Card IDs, which the company had kept from a pre-2021 points scheme; about 345,000 of those cards are still valid. Cardholder names, expiry dates and security codes were not included. Card issuer Credit Saison has seen no rise in fraud, is monitoring the cards and reissues them on request. Ryohin Keikaku says it blocked the access and has found no sign of the data on the dark web so far. Severity detail: Up to 27.26 million customer records plus about 345,000 valid full credit card numbers with birth dates; the intrusion method has not been disclosed - Product: MUJI app, Muji online store and MUJI Card data (Ryohin Keikaku) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes There is nothing to patch. If you hold a MUJI Card issued before August 2021, check your statements and consider asking Credit Saison to reissue it. Expect phishing that uses your email, birth date or name and claims to be from Muji or Saison; neither asks for card details by email or phone. ## Latest updates - Nov 4, 2026: Second report widens the breach: the 27.26 million records also cover Muji online store members and include member IDs, about 520,000 of them with names, addresses and phone numbers. About 1.09 million MUJI Card records with full card numbers, MUJI Card IDs and birth dates (about 345,000 cards still valid) were also accessible, plus about 120 saved cards (first 6 and last 2 digits and cardholder name). Credit Saison is monitoring for fraud and reissues cards on request. - Oct 30, 2026: Ryohin Keikaku discloses that up to about 27.26 million MUJI app customer records (email addresses, birth dates and gender, including former members) may have leaked. It says it blocked the access and applied a fix, and that card data, names, addresses and phone numbers were not involved. - Oct 29, 2026: A third party gains unauthorized access to Ryohin Keikaku's (Muji's) systems at about 1:00 a.m. Japan time, according to MUJI Card issuer Credit Saison. ## Advisories - [無印良品の公式アプリ「MUJIアプリ」におけるお客さま情報流出の可能性について（第一報）](https://www.ryohin-keikaku.jp/news/articles/2026_1030_01) (Ryohin Keikaku) - [無印良品の公式アプリ「MUJIアプリ」におけるお客さま情報流出の可能性について（第二報）](https://www.ryohin-keikaku.jp/news/articles/2026_1104_02) (Ryohin Keikaku) - [MUJI Card 会員情報の流出の可能性に関するお知らせとお詫び](https://www.saisoncard.co.jp/customer-support/information/20261104/) (Credit Saison) ## Write-ups & news - [無印良品、クレカ「MUJI Card」カード番号全ケタ、約109万件漏えいか　不正アクセスで続報](https://www.itmedia.co.jp/news/article/2611/04/2000002885/) - [Credit card numbers may have leaked in cyberattack on Japan's Muji](https://www.straitstimes.com/asia/east-asia/credit-card-numbers-may-have-leaked-in-cyberattack-on-japans-muji) ## Caveats Only MUJI Cards issued between October 2000 and July 2021 are in the card set; cards issued from August 2021 are not affected. Ryohin Keikaku and Credit Saison are contacting affected customers by email or post. The investigation into the cause and scope is ongoing. --- Machine-readable: https://pwn.watch/i/muji-ryohin-keikaku-app-breach-card-numbers-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.