2026 Ryohin Keikaku (MUJI) — unauthorised access to customer data in MUJI app; email, date of birth and gender; press figures up to 27 million including former members
Data compromised
Email addresses, date of birth and gender. The company says card numbers, names, postal addresses and phone numbers were not involved. Press reports put the affected total at up to about 27.26 million, including former members; that figure is not confirmed by the company in sources reviewed.
Technical writeup
Sourced from Japanese press reports of the company announcement; the release was not fetched. The corporate site returned errors during verification, so website and logo are blank.
Root cause
Ryohin Keikaku says a third party gained unauthorised access to customer data in its MUJI app. It blocked the access and applied a fix, and announced the incident on October 30, 2026.