Ryohin Keikaku, the Japanese company behind the Muji retail brand, said on November 4, 2026 that an attacker may have accessed about 1.09 million Muji Card customer records, including full credit card numbers. About 345,000 of those records belong to cards that can still be used today, and each of those records also holds the cardholder’s date of birth.
The disclosure is a second update to an incident the company first reported on October 30, when it said up to 27.26 million Muji App customer records may have leaked. The new findings widen both the group of people affected and the types of data involved.
What Ryohin Keikaku confirmed
According to card issuer Credit Saison, a third party gained unauthorized access to a Ryohin Keikaku system at around 1 a.m. Japan time on October 29, 2026. Ryohin Keikaku detected the intrusion, blocked the access and applied a fix, then published its first notice on October 30.
Further analysis found that old Muji Card data was still sitting on the compromised system. Until July 2021, Credit Saison shared the card numbers of Muji Card members with Ryohin Keikaku so the retailer could award its own loyalty perks. The company changed how points work after that and stopped receiving card numbers, but the older records were never removed. Ryohin Keikaku told Credit Saison about the possible card exposure on November 2.
The Muji Card records that may have been accessed include:
- Full card numbers (all digits) for cards opened between October 2000 and July 2021
- Dates of birth and Muji Card IDs (the Muji member ID)
- Name, address, phone number, gender and email address for some of those customers
Of the roughly 1.09 million card records, about 345,000 are for currently valid cards and about 745,000 are for cards that were canceled or have expired. Cardholder names as printed on the card, expiration dates and security codes were not part of the card data, according to Credit Saison’s customer notice. Muji Cards issued in August 2021 or later are not affected.
The Muji App exposure also grew
In its November 4 update, Ryohin Keikaku said the up to 27.26 million records it first linked to the Muji App also include members of the Muji online store who never used the app, as well as people who had already closed their accounts. The first notice listed only email addresses, dates of birth and gender. The data now also includes member IDs, and about 520,000 of those records contain names, home addresses and phone numbers.
The company also found that partial card data for about 120 customers who saved a payment card in the Muji App or online store may have been accessed. That data is limited to the first 6 and last 2 digits of the card number and the name on the card.
Ryohin Keikaku said it has not found the data on the dark web and has not confirmed any misuse. The Muji App and online store are operating normally. The company has not disclosed how the attacker got in.
Credit Saison is watching for fraud
Credit Saison said the breach stems from Ryohin Keikaku’s system and that it has found no unauthorized access to its own systems. The issuer has stepped up monitoring of Muji Card activity and said it has not seen any increase in fraudulent use so far. Cardholders who want a new card can request a reissue from Credit Saison, though delivery may take some time.
Ryohin Keikaku and Credit Saison will contact affected customers by email or postal mail. Credit Saison will reach Muji Card members whose contact details Ryohin Keikaku does not hold.
Not linked to the Arara email breach
The Muji disclosure lands in the middle of a wave of Japanese data leaks. Several companies, including Bic Camera (about 14.9 million records), Workman (up to 1.45 million email addresses), Airdo (673,920 email records) and Solaseed Air (up to 490,000 email addresses), have tied their leaks to the breach at email delivery provider Arara, according to Kyodo News.
Ryohin Keikaku has not linked its incident to Arara. Both its notices and Credit Saison’s describe unauthorized access to Ryohin Keikaku’s own system, starting with the Muji App. Japan has seen several other large retail and travel breaches in recent weeks, including the Club Tourism breach of 4.32 million member records.
What Muji customers should do
Ryohin Keikaku and Credit Saison are asking customers to:
- Review recent card statements and report any charge you do not recognize to Credit Saison, the Muji Card issuer.
- Consider requesting a replacement card if you joined Muji Card between October 2000 and July 2021.
- Watch for fake emails, texts and calls that pretend to be from Muji or a card company. Neither company will ask for card numbers, PINs or security codes by email or phone.
- Avoid entering card details through links in unexpected messages. Go to the official website instead.
Because full card numbers and dates of birth may be in an attacker’s hands, phishing that looks like a Muji or Saison notice is a real risk. Our guide on what to do if your credit or debit card was exposed in a data breach walks through each step, from checking statements to locking down your card. For another recent retail case involving stored cards, see the Revolve breach that exposed saved payment cards.
