For: people who have registered with the MUJI app, including those who have since left. This article is based on the official notice from Ryohin Keikaku Co., Ltd. and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 31, 2026Not yet known
- Whether the data actually left the company
- Cause and how the intruder got in
- How and when affected people will be contacted
- Breakdown of the count (for example, people who withdrew)
- When the unauthorized access happened or was detected
The company says it will contact customers whose data may have leaked in sequence, and will announce promptly by press release or similar if a leak outside the company is confirmed.
What users should do today
Do not open URLs in emails claiming to be MUJI; check in the app or official site
The items that may have leaked are email address, date of birth and gender. With email addresses possibly leaked, emails claiming to be MUJI could arrive at any time. The company itself warns that spoofed emails using the leaked data may be sent, and asks people not to click URLs in suspicious emails or enter personal data.
If an email about "apology coupons", "expiring points" or "confirming your member details" arrives, do not open the link; open the MUJI app or the official site yourself to check (see What is phishing?).
Review services that use your date of birth to verify you
Unlike an email address, a date of birth cannot be changed. Many banks, shops and phone carriers use it as the answer when you contact them or reset an account.
Check that you have not used your date of birth as a password or as the answer to a security question, and replace it if you have. Do not rely on a password alone for login: turning on multi-factor authentication makes an account harder to take over even if your date of birth is known.
Never give anyone your password or card number
Passwords and card data are not among the items in this notice. Even so, if an email asks you to call a number or reply to "confirm" something, do not type or say your password or credit card number.
A sender who knows your date of birth and gender is not proven genuine by that, because that is the data that may have leaked.
If you reuse the same password elsewhere, separate them
Passwords do not appear in the notice, so there is nothing here that makes you change one. But email addresses are often used as login IDs, and a reused password lets one leak spread to other services.
A password manager is the realistic way to do the inventory. You can check whether a reused password appears in past leaks with How to check if your password was leaked.
You may be affected even if you have withdrawn; judge any contact by its content
The notice says the data of customers who have withdrawn is included. Even if you no longer use the app, if you once registered, follow the steps above in the same way.
The company says it will contact customers who may be affected in sequence, but the notice does not say how. If you cannot tell whether a message is genuine, do not open its links; compare it with the notice on the company's official site.
Contact the company through the channel in its notice
The notice gives a customer line: the customer service desk, toll-free 0120-64-0772 (Monday to Saturday, 9:30 to 17:00, excluding Sundays and the New Year holidays; calls from Japan). Use the channel in the company's notice, not a phone number or URL in a message you received.
What happened (from Ryohin Keikaku's notice)
Ryohin Keikaku published "About the possible leak of customer information in the official MUJI app" on October 30, 2026 (the PR TIMES distribution was at 14:10). Everything below is based on the company's notice.
Before the notice (date not disclosed)
Unauthorized access from outside was detected. The company blocked access to the affected point and applied a fix. The notice does not give the date it happened or was detected.October 30, 2026
The company announced that part of customer data may have leaked. The number is up to about 27.26 million records, including people who have withdrawn.Next (company's plan)
It will contact customers who may be affected in sequence, and will announce promptly by press release or similar if a leak outside the company is confirmed.
- Service concerned
- Customer data held in the MUJI app
- Number
- Up to about 27.26 million records (including customers who have withdrawn). This is the number that may have leaked, not a confirmed count of what was taken
- Items that may have leaked
- Email address, date of birth, gender
- Items said not to be included
- Credit card data, names, addresses, phone numbers and similar
- Cause
- The company says it detected unauthorized access from outside. The notice does not give how the intruder got in or the specific cause
- Response
- Blocked access to the affected point and applied a fix. It says it will further strengthen security measures and monitoring together with its development company and affiliates
- Harm
- At the time of the notice, it says it had not confirmed any leak to the dark web or harm from misuse of the data
- Service
- The MUJI app and the MUJI online store work normally
What is known and what is not
Status as of October 31, 2026. When a follow-up notice is published, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access | Detected from outside; blocked and fixed | Confirmed (company) |
| Number of records | Up to about 27.26 million (including people who withdrew) | May have leaked (company) |
| Email address | An item that may have leaked | May have leaked (company) |
| Date of birth | An item that may have leaked | May have leaked (company) |
| Gender | An item that may have leaked | May have leaked (company) |
| Credit card data, names, addresses, phone numbers | Not included | Not included (company) |
| Passwords | Do not appear among the items | Not stated |
| Leak to the dark web or harm from misuse | Not confirmed at the time of the notice | Not confirmed (company) |
| Whether the data actually left the company | The company says it will announce promptly if confirmed | Not confirmed (the company says it will announce if confirmed) |
| Cause and how the intruder got in | Not stated in the notice | Not stated |
| When it happened or was detected | Not stated in the notice | Not stated |
| Individual contact with affected people | Customers who may be affected will be contacted in sequence | Planned (company) |
| Service status | The MUJI app and online store work normally | Confirmed (company) |
How to read this: what ‘may have leaked’ and ‘no harm confirmed’ mean
The company writes that the items "may have leaked". That means it is not a confirmed count of data actually taken; it does not mean nothing leaked. "No harm confirmed" means none had been found at the time of the notice; it does not mean the data will never be used.
In general, a date of birth and gender cannot be changed, so they can be used months or years later as material for other scams or account takeovers (this does not mean it happened here).
What an email address, date of birth and gender can enable
The following is what such a combination of items can generally enable. It does not mean any of it happened in this case.
- Email address: becomes the target for spoofed emails (phishing). The company itself warns that spoofed emails may arrive.
- Date of birth: some shopping, financial and telecom services use it as an identity check or as part of an easily guessed password. Because it cannot be changed, the services that rely on it need to switch to other checks.
- Gender: low impact alone, but combined with an email address and date of birth it makes a fake message look more plausible.
The notice says names, addresses and phone numbers are not included, so fake postal mail or phone calls that use your name or address are harder to build from this incident's items alone. They could still be combined with data collected in other leaks, so a message that has your name is not proof that it is genuine.
Email address
↓→
Target for spoofed emails (phishing)
→ Do not open links / check in the official app
Date of birth
↓→
Can be used as an identity check or a guessable password
→ Switch to other checks / turn on multi-factor authentication
Said not to be included in the notice
- Credit card data
- Names
- Addresses
- Phone numbers
May have leaked
- Email address
- Date of birth (cannot be changed)
- Gender (cannot be changed)
What operators should review
The cause has not been disclosed, so this lists only what follows from what was published.
Decide how long, and why, you keep the data of people who leave
The affected records include people who have withdrawn. Some items are kept for a period after withdrawal because of law or fraud prevention, but items with no reason to keep them should be deleted after a set period or replaced with a form that does not identify a person.
The more records you hold, the more people one incident reaches. Set the retention period for each type of data.
Check why you hold items that cannot be changed, such as date of birth and gender
Apart from the email address, the items in this notice are ones people cannot change later. Decide the range you need for coupons or age-based offers, and if possible hold a coarser form such as an age band.
Sources
- Ryohin Keikaku Co., Ltd., "About the possible leak of customer information in the official MUJI app" (October 30, 2026; the title is a translation of the Japanese original) — ryohin-keikaku.jp (news page) and the PDF the company publishes there; the same notice as distributed by the company on PR TIMES
- Press: INTERNET Watch, Fukui Shimbun (both in Japanese)
A note on sources
This article is based on the company's news page and the PDF of the notice (dated October 30, 2026) linked from it. The PR TIMES distribution is a copy of the same notice, and it also matches the two press reports.
Update history
2026-10-31: First version, based on Ryohin Keikaku's notice of October 30. The company says it will announce promptly if a leak outside the company is confirmed. We will update this article when it does.
Read next
- Preparing for follow-on scams: What is phishing? / Smartphone security basics
- Protecting your accounts: Getting started with multi-factor authentication / Choosing a password manager / How to check if your password was leaked
- A similar case (app member data): MrMax app and online store breach
- Other 2026 incidents: Data breaches and cyberattacks (Japan and overseas)