Muji apologises after 1.09 million card numbers it should have deleted were exposed
Ryohin Keikaku, the company behind Muji, apologised on 12 November for keeping about 1.09 million full MUJI Card numbers it should have deleted years ago, which may have been accessed in an October cyberattack. It will pay reissue fees for about 345,000 cards that are still valid, while its Japanese online store remains offline after a separate wave of credential-stuffing logins.
The Japanese company that runs Muji has apologised for holding on to about 1.09 million full credit card numbers that it should have deleted years ago, data that may have been taken in a cyberattack on its systems in late October. At a press conference in Tokyo on Thursday 12 November, Ryohin Keikaku President Satoshi Shimizu said part of the company's system had a vulnerability and that card data which "should naturally have been destroyed" had been left in place. The company will cover the cost of reissuing cards for affected customers whose cards are still valid.
The admission is the latest development in an incident that has grown in stages. Ryohin Keikaku first disclosed on 30 October that information linked to up to 27.26 million customer records from its MUJI app and online store may have been exposed. Since then it has twice widened the scope, and its Japanese online store has been offline since 6 November after a separate attack using stolen passwords.
What did Muji's operator say on Thursday?
Shimizu opened the press conference by apologising for three things, according to WWD Japan: failing to prevent the unauthorised access, keeping MUJI Card numbers and related data that should have been destroyed, and the extended shutdown of the Muji online store. Executives repeatedly acknowledged the retention of card numbers as "our fault", the trade publication reported.
Nikkei quoted Shimizu as saying that "part of the system had a vulnerability" and that the company took seriously its failure to stop the intrusion. The quotations were made in Japanese and are translated here.
On compensation, Nippon TV's news network NNN reported that the company will pay the reissue fee for customers holding the roughly 345,000 affected cards that are still valid, if they ask for a new card. Any further compensation would be decided "while checking each case one by one", the company said.
Why did Muji still have full card numbers?
The MUJI Card is a co-branded credit card issued by the Japanese card company Credit Saison. According to the company's explanation reported by WWD Japan and CNET Japan, Credit Saison supplied card numbers to Ryohin Keikaku so that Muji could identify cardholders and give them store-specific rewards. In July 2021 Ryohin Keikaku changed its system to use a different identifier instead of the card number.
The company said it knew at the time that the old card numbers should be removed, but they were never deleted. The numbers were stored in full, all 16 digits, without masking, the partial hiding of digits that is a common protection. The legal news service MLex reported that Credit Saison had asked for the data to be deleted in 2021, raising questions about Japan's data-retention obligations under its privacy and card-payment laws.
The principle at stake is simple: data that a business no longer needs cannot be stolen from it if it has been deleted. Payment-industry security rules generally discourage merchants from storing full card numbers unless they are needed and protected.
What information may have been exposed?
Based on the company's disclosures, as reported by CNET Japan, Kyodo News and others, the potentially exposed data falls into several groups:
- About 1.09 million MUJI Card records for members who joined between October 2000 and July 2021. These include the full card number, MUJI Card member ID and date of birth, and for some people their name, address, phone number, gender and email address. About 345,000 of the cards are still usable; about 745,000 have been cancelled or have expired. The cardholder name, expiry date and security code were not included in this data.
- App and online store accounts, totalling up to 27.26 million records announced on 30 October, including email addresses, dates of birth, gender and member IDs. About 520,000 of these also include names, addresses and phone numbers, and the total includes people who had closed their accounts.
- About 120 saved payment cards in the app or online store, where the first six and last two digits and the cardholder name may have been seen, but not the full number, expiry date or security code.
- Cash-on-delivery recipients. In its fourth update on 9 November, the company said it had confirmed unauthorised access to some information about customers who received cash-on-delivery orders from Muji stores or the online store between 2 January 2020 and 10 February 2025. Kyodo puts this group at about 440,000 customers.
Most of the affected customers are in Japan, where Muji has its largest store network and where the MUJI Card is issued.
When did the attack happen?
CNET Japan reported that the unauthorised access took place at about 1 a.m. on 29 October, Japan time. Ryohin Keikaku told Credit Saison on 2 November that card numbers might be involved, and the two companies announced the card exposure on 4 November. Credit Saison said it had found no intrusion into its own systems and no leak from them.
As of the 4 November announcement, the companies said they had not found the data on the dark web or seen any misuse, and Credit Saison said it had not detected an increase in fraudulent card use. The company has not publicly said who was behind the attack.
A separate problem emerged later. In its 9 November statement, Ryohin Keikaku said its online store, which it had paused from 4 p.m. on 6 November, had been hit by a "list-type attack", known in English as credential stuffing: attackers try large numbers of email and password combinations stolen from other services, hoping people have reused them. The company said some accounts may have been logged into by people other than their owners, postponed the store's reopening and said it plans to ask every customer to set a new password when it returns. NNN reported on Thursday that there is still no date for reopening.
What are affected customers being told?
Ryohin Keikaku and Credit Saison said they began contacting affected customers individually by email or post from 10 November. Customers they have no contact details for are being notified through the company's public statements. Credit Saison said it is monitoring MUJI Card accounts more closely and will reissue cards on request, though a new card can take time to arrive.
The companies have asked cardholders to check their statements and contact Credit Saison about any charges they do not recognise. They have also warned about fake emails, text messages and phone calls pretending to come from either company, and said they never ask customers for passwords or card numbers in that way. For the online store, the company recommends using a password not used on any other service.
Why does this matter beyond Japan?
The incident is part of a run of cyberattacks on Japanese companies, and Muji is a global brand with stores across Asia, Europe and North America, although the disclosed customer data relates to its Japanese app, online store and card. It also illustrates two common weaknesses. The first is keeping old data after a system change, where a later breach exposes information the business had stopped using. The second is password reuse, which lets attackers who stole credentials elsewhere break into accounts without hacking the company directly.
What happens next?
Several questions remain open: how the attackers got in, whether any of the data has been misused, when the online store will reopen and whether the retention of card data will draw regulatory scrutiny, as MLex has suggested. Ryohin Keikaku said it will continue investigating the cause and the scope of the breach and will publish new findings promptly.
Image: Photo: Wing1990hk, CC BY 3.0 (https://creativecommons.org/licenses/by/3.0/), via Wikimedia Commons (https://commons.wikimedia.org/wiki/File:Muji_Grand_Front_Osaka_201407.JPG) — July 2014 file photo of a Muji store in Osaka, resized; not related to the incident
About this article: prepared by The Daily Context editorial desk using automated, source-based reporting from the publications linked below. No reporter was on the ground.
Sources
- Kyodo News, Muji operator says retained card data may have been leaked: https://english.kyodonews.net/articles/-/91173
- Kyodo News, Muji among latest firms hit by data breach: https://english.kyodonews.net/articles/-/90309
- Ryohin Keikaku, fourth update on the MUJI app incident (Japanese): https://www.ryohin-keikaku.jp/news/articles/2026_1109_01
- CNET Japan (Japanese): https://japan.cnet.com/article/35254387/
- WWD Japan via Yahoo! News Japan (Japanese): https://news.yahoo.co.jp/articles/2edf0c190ca6deb97cb564f09ea17050579b4048
- NNN via Yahoo! News Japan (Japanese): https://news.yahoo.co.jp/articles/331833b3e9aabb3e73a9221655e4b0d027f59eb7
- Nikkei (Japanese, subscription): https://www.nikkei.com/article/DGXZQOUC10A8K0Q6A111C2000000/
- MLex: https://www.mlex.com/mlex/articles/2547160/japan-s-muji-faces-questions-over-retained-card-data-after-cyberattack
Kabeer Ahmad
Kabeer Ahmad is the founder and editor of The Daily Context. He oversees the site's source-based coverage of world affairs, technology, business, entertainment, lifestyle and sports, and is responsible for its editorial standards, sourcing and corrections.
