MUJI App Data Leak: Up to 27 Million Records Exposed
Ryohin Keikaku has announced that up to 27.26 million MUJI app user records may have been accessed by an unauthorized third party.
Quick facts
- Maximum of 27,260,000 user records potentially affected.
- Exposed data includes email addresses, dates of birth, and gender.
- Credit card numbers, names, addresses, and phone numbers are not affected.
Why it matters
The scale of this breach is notable due to the inclusion of legacy data from former users, which often presents a higher risk for identity-related fraud. While the exclusion of financial data like credit card numbers is a positive development for security, the exposure of email addresses and birth dates provides sufficient information for sophisticated phishing campaigns. The company's immediate response to patch the vulnerability is standard, but the long-term impact depends on whether the stolen data is successfully weaponized by malicious actors in the coming weeks.
Ryohin Keikaku, the operator of the retail brand MUJI, announced on October 30, 2026, that unauthorized access to its official "MUJI app" may have resulted in the exposure of up to 27.26 million user records. As of October 30, 2026, the company confirmed that it has blocked the affected access points and applied security patches to address the vulnerability.
Why it is trending now
The announcement is trending as users seek clarity on whether their personal information was compromised. According to reports from NHK and Impress Watch, the company identified a breach involving customer data, prompting concerns among the millions of registered users in Japan and abroad who rely on the application for shopping and store services.
Key facts
- The incident potentially involves a maximum of 27,260,000 records, including those of users who have already deleted their accounts, according to Ryohin Keikaku.
- The specific data points identified as potentially leaked are limited to email addresses, dates of birth, and gender, as reported by Impress Watch.
- Ryohin Keikaku stated that no credit card information, names, physical addresses, or telephone numbers were included in the leaked data, per Yahoo! News.
- The company has confirmed that the MUJI app and its online store remain fully operational as of the latest update.
Why this is trending in Japan
As a widely used retail application in Japan, the news has caused significant concern regarding user privacy and the potential for phishing attempts. The high number of affected accounts has made this a top search topic as customers look for official guidance on how to secure their accounts.
Background and context
Ryohin Keikaku discovered the unauthorized access through its internal monitoring systems. The company is currently working with related development partners to strengthen its security and monitoring infrastructure. While there is no current evidence that the stolen information has appeared on the dark web or been used for malicious purposes, the company has issued a warning regarding potential "impersonation emails" (phishing) that may target affected users.
What happens next
Ryohin Keikaku has committed to contacting all individuals whose information may have been leaked in sequential order. Users are advised to remain vigilant against suspicious emails or messages that appear to come from the brand. The company continues to monitor for any signs of data misuse while conducting a deeper investigation into the security breach.
Frequently asked questions
What data was leaked from the MUJI app?
The leaked data is limited to email addresses, dates of birth, and gender. Ryohin Keikaku has confirmed that credit card details, real names, physical addresses, and phone numbers were not part of the compromised information.
Are my credit card details safe?
Yes. According to the official statement from Ryohin Keikaku, credit card information was not included in the data that was potentially accessed by the unauthorized third party.
Are deleted accounts included in the breach?
Yes. Ryohin Keikaku has stated that the maximum count of 27.26 million affected records includes information belonging to users who have previously deleted their accounts from the MUJI app.
Is the MUJI app safe to use now?
The company has applied security patches and blocked the unauthorized access points. As of the latest update, both the MUJI app and the online store remain operational, though users should always monitor for suspicious activity.
How will I know if my data was leaked?
Ryohin Keikaku has announced that they will contact users whose information may have been compromised sequentially. Users should be wary of any unsolicited emails or messages claiming to be from MUJI during this time.
What should I do to protect myself?
Users should be cautious of 'impersonation emails' or phishing attempts that may use the leaked information to appear legitimate. Avoid clicking suspicious links and monitor your accounts for any unusual activity.
In this story
Sources
Trend snapshot
- Topic
- Technology
- Trending in
- Japan
- Search interest
- 1000+ recent searches
- Status
- Verified: 3 independent outlets
- Last updated
- Oct 30, 2026 at 3:45 PM
Last checked Oct 30, 2026 at 3:45 PM. Trends move fast, so details may change. How we work · How we verify
Comments