Ryohin Keikaku, the company behind the Muji retail chain, said at a November 12 news conference that it used full credit card numbers to identify customers until July 2021, and that it stored them unmasked and unencrypted, ITmedia News reported.
President Satoshi Shimizu and other executives apologized at the conference in Tokyo. Asked about the numbers left undeleted, they said the company's data operations had been inadequate. "It was our fault," they said.
Ryohin Keikaku said on October 30 that outside parties may have gained unauthorized access to as many as about 27.26 million pieces of customer data, including records in its Muji app. It initially said card information was not affected.
On November 4 the company said full card numbers and other data for about 1.09 million customers who joined the MUJI Card between October 2000 and July 2021 may also have been accessed.
The numbers were collected to give MUJI Card holders their own perks, according to the November 4 announcement. The company changed the system behind those perks in July 2021 and stopped linking card numbers to it. Some numbers collected before the change were never deleted.
At the conference, reporters pressed the company on why it held full numbers and whether it needed to hold them at all. The company said it had used card numbers to identify customers until July 2021.
Executives said the data was not kept on purpose. They pointed instead to improper practice in how the data was operated and managed. They said they have not yet determined whether the missed deletions came from human error or a system problem, and that the investigation continues.
Whether the law was broken
Reporters also asked whether holding the numbers violated the law. The revised Installment Sales Act, in force since June 2018, requires merchants that accept credit cards in principle either not to retain card information or to manage it in line with PCI DSS, an international security standard for card data.
The company said it had been aware of the no-retention requirement since then. Whether it actually broke the law is still being checked, it said.
Timing of the disclosure
Questions also covered the timing of the November 4 disclosure, which came as the Muji Week sale ended. The sale ran in stores from October 23 to November 3 and on the Muji online store until 10 a.m. on November 4.
The company said the sale played no part in the timing. Shimizu said pinning down the scope of the card data's exposure required checks with other companies, which took time. He said the company disclosed as early as it could.
Ryohin Keikaku said on November 9 that its online store had been hit by a list-type attack, in which a third party repeatedly tries logging in with IDs and passwords possibly obtained illicitly elsewhere.
At the conference the company said the store had seen large numbers of login attempts from multiple IP addresses over a long period. It judged the pattern a list-type attack because the number of attempts and the failures that followed were "enough to make that call." The attack that led to the card data being accessed was different from the list-type attack, it said.
The investigation detected several unauthorized accesses sharing common elements, but the attack patterns varied widely, so grasping the full picture took time. The company said it will keep investigating the cause and will review how it manages information and strengthen security. It will also cover in full the fees customers incur to have affected cards reissued.