Security notice
Run an online store with customer logins? MUJI says attackers logged in with passwords stolen elsewhere.
On November 9, 2026, Ryohin Keikaku, the company behind MUJI, said its MUJI online store in Japan had been hit by a large number of login attempts using passwords that third parties may have obtained elsewhere, an attack known as credential stuffing, and that some customer accounts may have been logged into by someone other than the customer. It is the company's latest report on unauthorized access it first disclosed on October 30. Across its reports, the company says email addresses, birth dates, gender and member IDs for up to about 27.26 million records, including former members, may have been accessed, plus full card numbers for about 1.09 million MUJI Card credit cards whose details it collected until July 2021 and still kept on its systems. The online store has been closed since November 6 and its reopening is postponed. This is not a software flaw, so there is nothing to patch and no CVE. If your store has customer accounts, this is a reminder to protect them against reused passwords. (Ryohin Keikaku, Nov 9, Ryohin Keikaku, Nov 4, Ryohin Keikaku, Oct 30)
Updated November 12, 2026: Japan Times, citing Jiji, and Kyodo reported on a November 12 news conference about why the company still had full MUJI Card numbers. We added that below. The rest of this page is unchanged from our November 11 update. Previous update: Wednesday, November 11, 2026, 10:52 AM ET.
Update: why the card numbers were still there
- Kept full card numbers despite a deletion policy. Japan Times, citing Jiji, reported that Ryohin Keikaku had used full MUJI Card credit card numbers to identify customers when granting rewards until July 2021, then switched to using other information for identification, but continued to retain the full numbers despite adopting a policy of deleting them. The company said it is still investigating whether the retention was intentional. (Japan Times / Jiji, Nov 12)
- Stored without encryption. Kyodo reported that the company said the card numbers had not been encrypted or otherwise properly protected when they were stored. (Kyodo, Nov 12)
- Company will pay to reissue cards. Kyodo reported that Ryohin Keikaku plans to cover reissuance fees for credit cards that may have been affected. (Kyodo, Nov 12)
- For store owners: do not keep card data you no longer need. MUJI had a policy to delete full card numbers after it stopped using them for identification in July 2021, and still kept them, without encryption, for years. Review what card and customer data your store, plugins and past systems still hold, and delete what you no longer need. (Japan Times / Jiji, Nov 12, Kyodo, Nov 12)
What happened
- October 30: first report. Ryohin Keikaku said it detected unauthorized outside access involving the MUJI app, blocked it and applied a fix. It said email addresses, birth dates and gender for up to about 27.26 million records, including former members, may have leaked, and that card data, names, addresses and phone numbers were not included at that point. It has not said what the weakness was. (Ryohin Keikaku, Oct 30)
- November 4: wider than first thought. The company said the 27.26 million records also cover MUJI online store members, that some include names, addresses and phone numbers, and that some card information was also accessed. It said that until July 2021 it collected the card number, MUJI Card ID and birth date of customers who joined the MUJI Card, a credit card issued by Credit Saison, to give its own perks, and that this data was still on its systems. (Ryohin Keikaku, Nov 4)
- November 9: stolen-password logins. The company said its online store saw many login attempts using passwords and other details third parties may have obtained elsewhere, and that some accounts may have been logged into by someone other than the customer. It said this happened while it was already watching more closely after the first report. It also confirmed unauthorized access to some details of people who received cash-on-delivery orders from MUJI stores and the online store between January 2, 2020 and February 10, 2025. (Ryohin Keikaku, Nov 9, November 9 filing)
- Store closed. The online store has been closed since 4 PM Japan time on November 6, and the reopening is postponed with no date. The company says it is preparing to ask every customer to reset their password when the store reopens. (Ryohin Keikaku, Nov 9)
- Contacting customers. From November 10, Ryohin Keikaku and Credit Saison began contacting affected customers by email or post. (Ryohin Keikaku, Nov 9)
What data, as of November 9
- MUJI app and online store users, including former members: email address, birth date, gender and member ID for about 27.26 million records. About 750,000 of those also include name, address and phone number, and about 270,000 also include purchase history and points. (November 9 filing)
- MUJI Card members who joined by July 2021: full card number, MUJI Card ID and birth date for about 1.09 million cards. The company says about 345,000 of those cards are still valid and the rest have expired or been closed. It says the name on the card, expiry date and security code are not included. (November 9 filing, Ryohin Keikaku, Nov 4)
- Customers who saved a card in the app or online store: the first 6 and last 2 digits of the card number and the name on the card, about 120 cases. (November 9 filing)
- Cash-on-delivery recipients, January 2, 2020 to February 10, 2025: recipient name and postal code, about 440,000 cases. (November 9 filing)
- Misuse. The company says it has not confirmed any damage from misuse of the information so far. (November 9 filing)
Some summaries of this filing in English give different card details. We used the company's own filing and news releases.
Who should worry
- You have a MUJI app or MUJI online store account in Japan, or you joined the MUJI Card by July 2021.
- You run an online store where customers sign in with an email address and password.
- You keep customer or card data from old promotions, loyalty schemes or past systems that you no longer use.
If you never used MUJI's Japanese app or online store and your site has no customer logins, this notice does not apply to you.
What to do now
If you have a MUJI account or MUJI Card. This follows Ryohin Keikaku's advice.
- Use a password you do not use anywhere else. The company asks customers to set a password different from the ones they use on other services once the store reopens. (Ryohin Keikaku, Nov 9)
- MUJI Card holders: check your statements. The company asks you to contact Credit Saison about any charge you do not recognize. Credit Saison is monitoring for misuse and will reissue cards on request. Kyodo reported that Ryohin Keikaku plans to cover reissuance fees for cards that may have been affected. (Ryohin Keikaku, Nov 4, Kyodo, Nov 12)
- Watch for fake messages. The company says it never asks for passwords or card numbers by email, phone or text. (Ryohin Keikaku, Nov 9)
If you run an online store. These are general steps, not from Ryohin Keikaku. We are not claiming any tool, including EverThread, would have stopped this attack.
- Limit repeated login attempts. Ask your platform or developer whether your store limits failed logins, blocks automated login attempts and alerts you to sudden spikes.
- Offer two-step sign-in to customers if your platform supports it, and turn it on for every admin and staff account.
- Be ready to make customers reset passwords. Know how to force a reset and how you would tell customers, before you need to.
- Do not keep card data you no longer need. MUJI says card data it collected until July 2021 for its own member perks was still on its systems years later. Japan Times, citing Jiji, reported that the company kept the full numbers despite a policy of deleting them, and Kyodo reported that the numbers had not been encrypted. Find out what old customer and card data your store, plugins and past systems still hold, and delete what you no longer need. (Ryohin Keikaku, Nov 4, Japan Times / Jiji, Nov 12, Kyodo, Nov 12)
What to send your developer, agency or host
Ryohin Keikaku, which runs MUJI, said on November 9, 2026 that attackers used passwords obtained elsewhere to try many logins on its Japanese online store, and that some customer accounts may have been accessed. Please tell us whether our store limits repeated failed logins and blocks automated login attempts, whether we get an alert when failed logins spike, whether customers can turn on two-step sign-in, whether two-step sign-in is on for every admin and staff account, and how we would force all customers to reset their passwords if we had to. Please also list any old customer or card data our store, plugins or past systems still keep, so we can delete what we do not need. Sources: Ryohin Keikaku news releases of October 30, November 4 and November 9, 2026; Japan Times (Jiji) and Kyodo, November 12, 2026.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It is about attacks on MUJI's systems in Japan. It matters to you as a shopper if you have a MUJI account there, and as a store owner because stolen-password logins can hit any store with customer accounts.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see your store's login settings, your customer accounts or what data your store keeps, and we cannot tell you whether you were one of MUJI's customers.
Was it one attack or several?
Ryohin Keikaku describes unauthorized access first found through the MUJI app, reported on October 30, and stolen-password logins on the online store, reported on November 9. It has not said how the first access happened, and its tables do not clearly split which records came from which. (Ryohin Keikaku, Oct 30, Ryohin Keikaku, Nov 9, November 9 filing)
Is there anything to update?
No. This was an attack on one company, not a flaw in software you run. The general steps for store owners above are worth doing anyway.
Where can I follow official updates?
Ryohin Keikaku's news page (in Japanese). All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Ryohin Keikaku: Possible leak of customer information in the MUJI app (fourth report), November 9, 2026, in Japanese, checked November 11, 2026
- Ryohin Keikaku: Additional report on unauthorized access and postponement of MUJI online store reopening, filing dated November 9, 2026 (PDF copy of the stock exchange filing), in Japanese, checked November 11, 2026
- Ryohin Keikaku: Possible leak of customer information in the MUJI app (second report), November 4, 2026, in Japanese, checked November 11, 2026
- Ryohin Keikaku: Possible leak of customer information in the MUJI app (first report), October 30, 2026, in Japanese, checked November 11, 2026
- The Japan Times (Jiji): Muji operator fails to delete unnecessary credit card data, November 12, 2026, checked November 12, 2026
- Kyodo: Muji operator admits security flaw that may have exposed credit card data, November 12, 2026, checked November 12, 2026