Ryohin Keikaku, the company that runs the Japanese retailer Muji, said on October 30 that someone outside the company gained unauthorized access to its official MUJI app. The access may have exposed up to about 27.26 million customer records. The company's notice lists three fields that may be affected: email addresses, dates of birth and gender. The total includes records of customers who had already closed their accounts. Every report on the incident gives the same ceiling of 27.26 million. News On Japan describes these as "accounts", but the company's notice, as reported by Kyodo News, JBizNews and Japan's Web Security Diagnosis Center, counts records, not people. The company says it has not confirmed that any data has been misused or has appeared on dark web sites.
What Happened
The company posted a notice marked "urgent/important" on its corporate news site on October 30 and linked to it from the Muji online store. According to the notice as summarized by several outlets, Ryohin Keikaku:
- detected unauthorized access from outside the company to the MUJI app
- blocked access to the affected part of the system
- applied fixes
- found that the MUJI app and online store could stay in normal operation
Some early coverage says the access happened "on October 30". That is the date of the disclosure. The Web Security Diagnosis Center, which worked from the original Japanese notice, points out that the notice does not say when the access was detected or when it was blocked. JBizNews also reports that no intrusion date was given. The exact timeline is still unknown.
Ryohin Keikaku says it will contact people whose information may have leaked. It will also publish a further announcement if an external leak is confirmed. It plans to strengthen security and monitoring with the help of its app developer and related companies, and it apologized to customers.
The disclosure came during a wave of Japanese breach announcements:
- All Nippon Airways reported data on about 37,800 customers taken through its contractor Amadeus (Kyodo News).
- Japan's Foreign Ministry reported about 3,600 possibly exposed records (Kyodo News, TBS).
- The beef bowl chain Matsuya reported about 2.38 million app and service users affected, including names and phone numbers (News On Japan, TBS).
- CHOTTO NEWS lists further same-week disclosures from a World Co. subsidiary (about 1.2 million records) and Yakult Honsha (about 40,000 records).
None of these reports links the Muji incident to any of the others.
What Was Taken
According to the company's notice, the data that may have been exposed is limited to:
- Email addresses
- Dates of birth
- Gender
The company says the following were not included: credit card information, names, physical addresses and telephone numbers. The Web Security Diagnosis Center notes that the notice says nothing about passwords either way, and that it gives no guidance on changing passwords.
Volume: up to about 27.26 million records. This includes customers who have closed their accounts. The notice does not say which registration period is covered. JBizNews and Techreview.si both note that it does not say which countries' customers are included. Muji operates outside Japan, but no report confirms whether non-Japanese app accounts are affected.
Status: the company describes this as a possible leak. It has not confirmed that the data was taken. At the time of the notice it had found no data on dark web sites and no harm from misuse.
Sensitivity: each record holds little sensitive data. The scale is the concern. An email address combined with a date of birth and gender is enough to write convincing personalized phishing, and dates of birth are still used as security questions and identity checks on some services.
Why It Matters
- Phishing at scale. Ryohin Keikaku itself warns that the data could be used in emails pretending to come from the company. The risk is sharpest right now, because the company has said it will contact affected customers but has not said through which channel or from which sender. That makes it easier for criminals to send fake "breach notifications" that look like the real thing.
- Retained data from closed accounts. Records of customers who had already left are part of the exposure. Data kept after an account is closed adds to the damage when a breach happens without serving any current business purpose.
- A cluster of Japanese incidents. Several breaches were announced in the same week across retail, food service, aviation and government. TBS reports separately that researchers investigating the attack on GMO found operational mistakes by that attacker. No one has publicly connected those findings to Muji. Defenders in Japan should expect a period of heavy phishing that mentions multiple brands at once.
- Large numbers, few details. The 27.26 million figure is an upper limit. Until the company publishes a confirmed count, readers should treat it as a ceiling, not a confirmed number of people affected.
The Attack Technique
Not disclosed. The company has not named a cause, an entry point, a vulnerability or an attacker, and no group has publicly claimed responsibility. The notice says only that there was unauthorized external access to "the relevant area" of the app and that a fix was applied. That wording fits an exposed app backend or API endpoint that was then patched, but this is an inference and the company has not confirmed it. No regulator filing or technical advisory has been published.
What Organizations Should Do
- Protect app backend APIs as carefully as websites. Test mobile app APIs for broken object-level authorization, missing authentication and endpoints that return far more data than needed. Rate-limit and monitor bulk enumeration of customer records.
- Delete data from closed accounts. Set retention limits for withdrawn members and enforce them. Data that no longer exists cannot be exposed.
- Use consistent customer notification channels. Announce publicly, in advance, which sender address and channel breach notifications will come from, and never include login links in them. This takes away the attacker's easiest phishing angle.
- Stop using date of birth as a verification factor. It is now widely leaked and should not be used to authenticate customers or reset accounts.
- Brief staff and customers on brand impersonation. Retailers and other consumer brands in Japan should expect phishing that mentions Muji, Matsuya, ANA and similar names. Strengthen DMARC enforcement on your own domains and tune mail filters for these lures.
- Check your third-party app developers. Ryohin Keikaku is working with its development partners on the fix. Review the security obligations, logging and incident-response terms in your own contracts with app developers.
Sources: Muji Says App Breach May Have Exposed 27.26 Million Customer Record... | Muji store operator says up to 27 mil. customer records may have le... | 【10/31最新】MUJIアプリ不正アクセス｜最大約2,726万件流出の可能性｜Webセキュリティ診断センター | 今日の脆弱性・情報漏えいレポート 2026年10月31日——MUJIアプリで最大約2,726万件、Linuxカーネルに認証不要の弱点（... | Cyberattacks Hit Muji, Matsuya, ANA and Foreign Ministry News On J... | Muji App Data Breach: 27.26M Records May Have Leaked | MUJI Warns Up to 27.26 Million App Customer Records May Have Leaked... | 無印・松屋・ANA・外務省でも…情報流出が続くなか“GMOサイバー攻撃”ではハッカー特定の糸口も 「攻撃者の重大ミス」か【news23...