Ryohin Keikaku, the operator of Muji, said at a news conference on November 12 that credit card numbers that should have been destroyed were still on file, unencrypted, and were used to identify MUJI Card holders for perks, ITmedia Business Online reported.
Unauthorized access to the Muji official app and online store may have leaked about 1.09 million records, including full MUJI Card credit card numbers. The company had systems and rules for storing card data safely. They were not carried out.
President Satoshi Shimizu said the company should have built governance as the business grew. He said he had focused on that since becoming president in 2024. "However, it was not enough. I reflect on this keenly. We fell short," he said.
Ryohin Keikaku had internal rules for handling company data and a Compliance and Risk Management Committee overseeing internal control. Neither worked, and a major security incident followed.
Four executives took questions at the news conference.
- Hirotaka Takahashi, senior executive officer overseeing administrative divisions
- Takahiro Miyazawa, senior executive officer overseeing the EC Division and IT Service Division
- Chika Hayashi, executive officer overseeing the IT Service Division
- President Satoshi Shimizu
"We only put up a policy"
Asked about the company's information security management setup, Takahashi said operating policies on information security and personal data protection existed. "Looking at this incident, they were not carried through. There is a strong reflection that we only put up a policy," he said.
He said the company had recognized the problem well before the breach. Since August he has overseen information security and personal data as head of the reporting line. "I can only apologize for causing this incident," he said.
Takahashi said the company had learned much from the breach and would bring in outside expertise rather than rely on its own remedies.
Shimizu said information reached him during the incident even though he was overseas and in a different time zone. He made the final decisions after grasping the sequence of events.
Takahashi said the company has criteria for setting up a crisis response headquarters. It convened one on October 29, the day the unauthorized access was detected, and still checks updates company-wide two to three times a day.
A cyberattack on Askul in 2025 took down the Muji Net Store online shop. Miyazawa said the company set up a security team in response and had outside firms run security tests, tightening access limits and fixing flaws. "But vulnerabilities we could not fully correct led to this unauthorized access," he said.
Asked whether outside expertise had been brought in, Takahashi said the company had been audited under Japan's internal control reporting system, known as J-SOX, and fixed any findings immediately. Since the Askul attack it had also commissioned outside system checks and diagnoses, acting within its means.
"As a result, I have to say it was not enough," he said. He acknowledged the company's knowledge had not kept up with the latest methods behind unauthorized access. "We want to respond as a whole company to catch up," he said.