Muji App Breach May Have Exposed 27.26m Records

Anyone who uses the Muji app should be wary of unexpected emails that claim to come from Muji. Ryohin Keikaku, the Tokyo company behind the Muji retail brand, says customer information held for its official app may have leaked after unauthorised access, covering up to about 27.26 million records. The exposed details are limited to email addresses, dates of birth and gender.

Ryohin Keikaku disclosed the breach in a news release on its corporate site on Friday 30 October, filed under urgent notices and investor relations, and Muji’s official X account posted an apology at 05:09 GMT (14:09 in Japan) pointing customers to it. In both, the company apologised deeply for the worry caused to customers and others concerned. The notice is in Japanese; the quotes and figures here are TSN translations from the original.

In brief

Ryohin Keikaku says up to about 27.26 million Muji app records may have leaked, including those of people who have since left the app.
The data at risk is email address, date of birth and gender. The company says no credit card details, names, addresses or phone numbers are involved.
It has blocked the access, applied a fix and says it has found no sign of the data on the dark web or of any misuse so far.

What Ryohin Keikaku says leaked from the Muji app

The company “has confirmed that some of the customer information it holds may have leaked externally” from the app, the notice says. The same text was distributed through the PR TIMES press release service at 14:10 Japan time. It lists three items as possibly exposed: email address, date of birth and gender. It adds that credit card information, names, addresses, phone numbers and similar details are not included.

The headline figure is given as “a maximum of about 27.26 million” records, and the notice says this includes information on customers who have cancelled their membership. The Japanese counts records rather than people, and Ryohin Keikaku has not said how many of them belong to current users.

On its response, the company says it “detected unauthorised access from outside” and then blocked access to the affected area and applied a fix. It gives no date for the intrusion or for its detection, and it does not say how the attackers got in or which part of the app’s systems they reached. It does say that, as of now, it has not confirmed the information appearing on the dark web or elsewhere, nor any harm from its misuse.

Both the app and the Muji online store are working normally, according to the notice. The company says it will strengthen security and monitoring further with the help of the app’s developer and related companies.

Ryohin Keikaku warns of spoofed emails

The practical advice in the notice is about phishing. Ryohin Keikaku says “spoofed emails” exploiting the information could appear, and it asks anyone who receives a suspicious message to take great care not to click any link in it or enter personal information.

The company says it will contact affected customers in turn, though the notice does not say whether that will be by email, through the app or by some other route. If it confirms that the data has actually left its systems, it says it will announce this promptly through a press release or similar, and it will take appropriate steps in line with Japan’s personal data protection laws. Customers can reach its customer service desk on a Japanese freephone line, 0120-64-0772, from 9:30 to 17:00 Monday to Saturday, closed on Sundays and over the new year. Journalists are directed to its public relations section.

The Muji disclosure is the latest in a run of Japanese breach notices this week. On Tuesday, the operator of the internet provider So-net said hackers had leaked 2.59 million member records and 54,401 mail passwords. On Thursday, the bulk email firm Arara said an attacker had taken 3.01 million email addresses from one of its mail servers. Japan Airlines, meanwhile, said booking data on about 92,000 customers was exposed through Amadeus.

The Muji app figure is large but the data set is narrow

At up to about 27.26 million records, the Muji app breach is roughly ten times the size of the So-net leak and nine times Arara’s, and far larger than the JAL exposure. Size is only half the picture, though. The three fields Ryohin Keikaku names are among the least sensitive a retailer holds: there are no passwords, no payment data, and no names or home addresses to pair with them.

That narrowness is also why the company’s own warning centres on email. An address on its own says little about its owner. An address paired with a date of birth and gender lets a message look personal, for example a birthday offer or a members’ notice that appears to know who it is talking to. Ryohin Keikaku has chosen to warn about spoofed emails before any misuse has been seen.

The notice also leaves real gaps. It describes a possible leak, not a confirmed one, and it gives no date, no route of entry and no split between current and former members. Nor does it say whether Muji app users outside Japan are part of the count. Until the company publishes the follow-up it has promised, the clearest guidance is the one Ryohin Keikaku itself offers: treat unexpected messages in Muji’s name with suspicion, and keep links and personal details out of reach of anyone who sends them.