Japanese retailer Muji’s operator has said about 1.09 million customer records, including credit card numbers, may have leaked after unauthorized access to its system — a sharply more serious disclosure than its first report a week earlier.
Ryohin Keikaku Co., which runs the Muji brand, said on Wednesday that about 345,000 of the potentially leaked MUJI Card records contain the full numbers of currently valid credit cards together with dates of birth, according to Kyodo News. Cardholder names, expiration dates and security codes were not included, the company’s second report said.
The card records cover MUJI Card members who joined by July 2021, the company said. It also said a small number of customers who had registered card information through the MUJI app or online store may also be affected.
What changed between the two reports
The November 4 update reverses the reassurance in the company’s first disclosure. On October 30, Ryohin Keikaku reported that up to 27.26 million customer records from its official MUJI app may have leaked, but said at that time that credit card information, names, addresses and phone numbers were not included.
The second report widens both the scope and the sensitivity of the data involved. It extends beyond app customers to MUJI Online Store customers, and adds full card numbers for the MUJI Card group. The company said it has so far found no evidence that the information has appeared on the dark web or been misused, but that wording is a statement of what has been found so far — not a guarantee that it will not be.
Why the valid-card figure matters
Not every leaked card number carries the same risk. Expired or cancelled cards cannot be used for new purchases, but the roughly 345,000 still-valid numbers, paired with dates of birth, are the records most useful to fraudsters — even without security codes or expiry dates, which the company says were not exposed. Affected customers should therefore watch statements closely and follow the card issuer’s advice, rather than assuming an old or rarely used card is safe.
Customers should also be alert to phishing: leaked email addresses and birth dates make it easier for scammers to craft convincing messages pretending to be Muji or a bank. The company has said it will never ask for credit card information by email or by phone.
Part of a wider Japanese breach wave — but a separate incident
The Muji disclosure landed in the middle of a string of Japanese breach announcements, but the incidents are not all the same breach. Electronics retailer Bic Camera said on Monday that about 14.9 million customer records, including email addresses, may have leaked through the email-distribution system of a contractor, Arara Inc., with no credit card information or shopping login credentials involved. Regional airlines Airdo and Solaseed Air and workwear producer Workman reported email leaks linked to the same Arara system.
Nomura Investor Relations separately said on Wednesday that a system serving institutional investors had been subject to unauthorized access, and that it had suspended the service while it investigates. Muji’s card-data disclosure stands apart from the Arara email cases because it involves full card numbers — a far more sensitive category of data.
What is still unknown
Ryohin Keikaku has not said who carried out the unauthorized access, how long it lasted, or exactly when the intrusion was discovered. It has not confirmed whether any of the card data has been misused, only that no misuse or dark-web leak has been confirmed so far. Those gaps matter: until the company completes its investigation, customers cannot know whether their own record was among those accessed, only whether they fall in the groups described.
The company is continuing its investigation, and further updates — including any change to the number of affected records — should be treated as the authoritative word over earlier estimates.
Frequently asked questions
How many Muji records may have leaked? About 1.09 million MUJI Card records, including card numbers, in the November 4 second report — plus up to 27.26 million app records reported on October 30.
Are the leaked cards still usable? About 345,000 of the potentially leaked records contain full numbers of currently valid cards, according to the company. Names, expiry dates and security codes were not included.
Has the data been misused? The company says no leak to the dark web and no damage from misuse has been confirmed so far. That is not the same as a guarantee that misuse will not happen.
What should affected customers do? Watch card statements, be wary of phishing emails or calls claiming to be Muji or a bank, and follow the card issuer’s instructions. Muji says it will never ask for card details by email or phone.
Sources
- Kyodo News, “Muji among latest firms hit by data breach, card data may have leaked” (published Nov 4, 2026; updated Nov 5, 2026)
- The Straits Times, “Credit card numbers may have leaked in cyberattack on Japan’s Muji” (Nov 5, 2026)
- MLex, “Japan’s Muji reports potential exposure of 1.1 million credit card numbers” (Nov 5, 2026)
File photos: the images in this article are file photos of Muji stores, not photos of the data breach itself.
