Murauchi.com data breach (7.7 million records): names, addresses and phone numbers leaked — past customers should watch for scam calls and mail

The company warns customers to be careful with emails, text messages and phone calls claiming to be from Murauchi.com, an online mall operator or a card issuer. It also says it will never ask for card numbers or passwords by email or phone.

Even if a caller says there is "a refund because of the data leak" or "compensation to process", do not give card numbers, bank details or PINs on the spot. Hang up and contact an official number you look up yourself.

Because home addresses leaked as well, fake notices may arrive as postcards or letters, not just email. Phone numbers leaked too, so text messages are also possible.

Do not use the URL, QR code or phone number in the notice; open the official website yourself and see whether the same notice is posted there. The company's official updates are collected on its page titled (in translation) "Apology and report on the leak of customer information due to unauthorized access" (how to spot fakes: What is phishing?).

A message that shows your real name, address, phone number and perhaps even your date of birth looks genuine.

But with this leaked data, a fake message can also contain correct personal details. If an older family member used the shop in the past, tell them this.

To check whether a notification email from the company is genuine, use the notice page on the company's website that you open yourself, not the links in the email.

The company has paused its social media accounts to focus on handling inquiries and says it cannot answer direct messages during the pause (it plans to resume in November 2026). Be careful with accounts that claim to be the company and contact you individually on social media.

The company's FAQ says that anyone who wants their registered personal data deleted should contact its dedicated address (privacy@murauchi.com), and that it will respond in line with the law and its own rules.

When you write, type the address yourself or copy it from the official page, rather than replying to an email you received.

The company says login IDs and passwords were not targeted. Still, if an old account there used the same password as other services, now is a good time to change those (Choosing a password manager).

The company's notices do not say how many years of data were involved. The point here is general, not a judgment of how the company stored its data.

The longer an online shop has been in business, the more data it holds on customers who have not bought anything for years. If that data leaks, it affects people who no longer remember using the shop, and notices are harder to deliver. Japan's Act on the Protection of Personal Information also asks businesses to make efforts to delete personal data without delay once it is no longer needed (Article 22, a duty to make efforts).

Decide what happens to the data of customers whose last purchase was a set number of years ago (delete it, or remove names and contact details and keep only figures for statistics), and run it on a schedule rather than by hand.

According to the company, card numbers and other payment data and login IDs and passwords were managed in separate systems and were not affected.

Not holding card numbers yourself (leaving them to a payment processor) and keeping credentials in a separate system limit how much can leak when an intruder gets in.

In the company's account, a vulnerability in a web system was the starting point, after which several systems were accessed.

List the network paths and permissions that lead from public-facing web servers to customer databases and internal systems, and allow only the connections that are needed. The review of access rights and credential management that the company lists among its prevention measures relates to this point.