Ryohin Keikaku, the company behind the MUJI retail brand, said on October 30 that customer information held through its MUJI app may have leaked — up to about 27.26 million records. The figure includes people who have already closed their accounts.
The potentially exposed fields are email addresses, dates of birth and gender. Credit card details, names, addresses and phone numbers were not among them, the company said.
Ryohin Keikaku, based in Tokyo's Bunkyo Ward, said it blocked access to the affected system after detecting unauthorized access from outside and then applied a fix. It has so far found no evidence that the data has surfaced on the dark web or been misused.
Disclosure during a member sale
The announcement came while MUJI Week — the chain's periodic member discount campaign — was running. The company did not say whether the timing was connected to the breach.
Ryohin Keikaku said it will contact affected users in turn, and will make a further announcement if it confirms that data actually left the company. It also warned users to watch for phishing emails that could exploit the leaked information.
The MUJI app and the company's official online store, MUJI Net Store, are both still operating as normal, according to the announcement.