Muji Says Full Card Numbers of 345,000 Customers May Have Leaked

Ryohin Keikaku, the operator of Muji, said an outside party may have accessed full card numbers on 1.09 million MUJI Card accounts, 345,000 of them still valid. It adds to the Oct. 30 app breach.

The 345,000 valid cards are the live exposure: affected cardholders are being notified by email or post, and the card issuer is taking reissue requests. Ryohin Keikaku said the numbers came from members who joined by July 2021 and had been collected to grant member rewards.

What was exposed?

The card records hold the full card number, the MUJI Card ID and the member’s birthdate. For 168,000 of the valid cards, Ryohin Keikaku’s system also showed an email address, gender and member ID. For 25,000 of those, it showed a name, address and phone number too.

Cardholder names, expiration dates and security codes were not in the card records, the company said. Separately, about 120 customers who had saved a card in the Muji app or online store had the first six and last two digits of the number exposed, along with the cardholder name; their expiration dates and security codes were not included.

What does the 27.26 million count?

The app breach has grown since Oct. 30. Ryohin Keikaku said up to 27.26 million app and online store members, including former members and people who never used the app, had an email address, birthdate, gender and member ID accessed. About 520,000 of them also had a name, address and phone number accessed. The company reported the card finding separately.

Another Japanese retailer disclosed a breach days earlier. Bic Camera said about 14.9 million customer records, including email addresses, may have leaked through a contractor that sends its email newsletters, and that no credit card data was involved.

What has Muji done?

Ryohin Keikaku said it has shut out the outside access, is notifying affected customers by email or post, and has found no sign that the data reached the dark web or was misused. It did not say how the outside party got in; the investigation is continuing. The company asks customers to check card statements for charges they do not recognize and to watch for suspicious emails or calls posing as the company or card companies; it said it never asks for card information by email or phone.

The MUJI Card’s issuer said it has stepped up monitoring of card transactions and is taking reissue requests from members who want a new card.

Which card numbers did the company collect years ago for loyalty perks and still hold in its own systems?