MUJI's Data Breach Is Wider Than First Disclosed

The company behind MUJI has widened its account of a data breach first disclosed on 30 October, when it reported that about 27.26 million customer records had leaked from its app, including email addresses, dates of birth and gender. Credit card data, names and addresses were said at the time to be unaffected.

The update says otherwise, in part. The affected group now includes users of the online store, not just the app, and for some of them the exposed data extends to names, addresses and telephone numbers.

The more serious disclosure concerns the MUJI Card, a co-branded credit card issued by Credit Saison. About 1.09 million cards belonging to members who joined before July 2021 are affected, of which roughly 345,000 are still valid. What leaked includes full card numbers, the MUJI Card ID and dates of birth.

It does not include cardholder names, expiry dates or the CVV code printed on the back — the details that would make a number straightforwardly usable. Separately, about 120 users who had stored card information in the app or the online store may have had their card data accessed, including the cardholder's name; in those cases only the first six and last two digits of the number were exposed.

The company says it will contact affected customers individually by email or letter, and that Credit Saison will help reach cardholders whose details are too incomplete to contact directly.

So far, MUJI says it has found no sign of the data appearing on the dark web or elsewhere, and no evidence of fraud or misuse. That is a statement about the present rather than a guarantee about the future, which is why the ordinary advice still holds: watch the card, and treat any message that already knows your date of birth with suspicion.