Ryohin Keikaku, the company behind the MUJI lifestyle brand, said on November 4 that full credit card numbers for about 1.09 million MUJI Card registrations may have been exposed in unauthorized access to its systems. The cards are issued by Credit Saison.
The company said the numbers were held to check membership and award points for users who registered a MUJI Card in its official app. Its current system no longer stores them, but older records survived, and Ryohin Keikaku called this its own failing.
Old records left in place
On October 30, Ryohin Keikaku said unauthorized access to the MUJI app may have exposed email addresses, dates of birth and gender for about 27.26 million memberships, including people who had cancelled. It said card details, names, addresses and phone numbers were not involved.
On November 4 it widened that disclosure. Users of the MUJI online store, not only the app, were affected, and names, addresses and phone numbers may have leaked in some cases.
The card numbers add a further layer. Full numbers, member IDs and dates of birth may have leaked for about 1.09 million people who joined MUJI Card by July 2021. About 355,000 of those cards are still valid; the rest have expired or been cancelled. For some valid cards, email addresses, names and addresses were also viewable from outside.
People who entered card details into the MUJI app or the online store may also have had the first six and last two digits of their card number and the name on the card exposed. Expiry dates and security codes were not included in either case.
A spokesperson for Ryohin Keikaku's public relations division told J-CAST News on November 5 that the numbers were stored in the past to identify members and award points when a MUJI Card was registered in the app. A system change in 2021 ended the practice, the spokesperson said, but "the old data remained without being deleted."
“We are withholding details of the storage format for security reasons, but we accept that sufficient protection was not in place as our own failing.”a spokesperson for Ryohin Keikaku's public relations division, told J-CAST News
The company said it will review and properly compensate anyone who suffers actual harm caused by the incident. It said no unauthorized use or secondary harm has been confirmed so far.
Card issuer says its own systems were not breached
Credit Saison said the unauthorized access was to Ryohin Keikaku's systems and that no breach of its own systems has been confirmed. It said it will step up monitoring for fraudulent use and reissue cards on request, and that affected customers will be contacted individually.
The disclosure of full card numbers drew alarm on X, where users wrote that the situation was no laughing matter and asked how serious it was.