Ryohin Keikaku, the company behind Muji, said on November 4 that full credit card numbers and other personal data for about 1.09 million MUJI Card holders may have leaked after unauthorized access, a disclosure that came the day after its "Muji Week" sale ended.
The operator, based in Tokyo's Bunkyo Ward, halted all online store services and some functions of its official app on November 6. On X, users questioned why the announcement and the shutdown followed so closely on the sale.
Muji Week, held from October 23 to November 3, gave shoppers 10% off online and in stores when they showed the MUJI app. It is a regular promotion.
Scope of the possible leak
The November 4 notice was a follow-up to an October 30 announcement about unauthorized access to the MUJI app. It widened the range of people whose information may have been exposed.
It also said full card numbers for about 1.09 million registrants who joined MUJI Card by July 2021 may have leaked. The company said it collected card details at the time to offer its own perks, and that the data remained in its systems.
Questions over timing
Posts on X asked why the company disclosed the leak and stopped the online store right after the promotion. "Announcing a credit card data leak after the sale ends is unthinkable," one read. Another called the handling "malicious, if anything."
Asked about the timing, Ryohin Keikaku told J-CAST News it gives priority to grasping the facts accurately and disclosing information to those affected promptly. It said it announces details after scrutinizing and organizing what should be made public.