Ryohin Keikaku, the company behind MUJI, said on Nov. 9 that it will delay the reopening of its MUJI online store, which has been suspended since Nov. 6, after a third party reported a list-type attack using IDs and passwords possibly obtained elsewhere, and about 270,000 more records may have leaked.
A list-type attack — credential stuffing — reuses IDs and passwords stolen from other services to break into accounts where people have reused them. The information that may have leaked includes email addresses, dates of birth, names, addresses, phone numbers, purchase histories and loyalty points.
No damage from misuse of the data has been confirmed so far. Ryohin Keikaku and Credit Saison, which issues the MUJI Card credit card, will contact affected customers by email and post from Nov. 10.
Breach figures revised upward
The company also revised figures it had already published. It had said roughly 520,000 of a maximum 27.26 million records included names, addresses and phone numbers. That figure is now about 750,000.
The company also disclosed a further possible leak. About 440,000 sets of delivery details for cash-on-delivery orders placed at MUJI stores and the online store between Jan. 2, 2020, and Feb. 10, 2025, may have leaked.
Password reset planned for all users
Ryohin Keikaku said it will announce a new reopening date once the necessary countermeasures and checks are complete. It is preparing to ask every user to reset their password when the store returns.
The company urged users to set passwords that differ from those they use on other services.
On Oct. 30, Ryohin Keikaku said unauthorized access to its MUJI app may have leaked up to about 27.26 million members' details. A second notice on Nov. 4 widened the scope to include MUJI Card numbers.
At 4 p.m. on Nov. 6, the company suspended the online store to strengthen security further and shut down all MUJI app functions except the barcode display used as a membership card.