Quick Answer
The MUJI data breach now includes potentially accessed full MUJI Card numbers for about 1.09 million accounts, Credit Saison says. The November 4 update also expands the affected population to MUJI online-store users and identifies possible exposure of names, addresses, phone numbers, and some stored card data. Monitor accounts, contact the issuer about replacement, and treat unexpected messages as phishing.
Key Takeaways
- About 1.09 million MUJI Card accounts may have had full card numbers, birth dates, and MUJI Card IDs accessed.
- About 345,000 potentially affected MUJI Cards remained valid as of the issuer’s November 4 update.
- MUJI says the affected group includes online-store users, including people who do not use the MUJI app.
- Cards issued from August 2021 onward are outside the incident, according to Credit Saison.
- MUJI and Credit Saison say they have not confirmed dark-web publication or increased fraudulent MUJI Card use.
What changed in the MUJI data breach on November 4?
The MUJI data breach expanded substantially on November 4, when Ryohin Keikaku and MUJI Card issuer Credit Saison disclosed that potentially accessed data could include full MUJI Card numbers and broader online-store customer information. MUJI’s October 30 notice had said that up to approximately 27.26 million records could include email addresses, dates of birth, and gender, while initially stating that names, addresses, telephone numbers, and payment-card data were not included.
The later update changes the practical risk assessment because the potentially affected information is no longer limited to profile data. MUJI says that some affected records may include names, postal addresses, telephone numbers, and some stored credit-card information. The affected group also includes MUJI online-store users, including customers who do not use the MUJI app, according to Ryohin Keikaku’s November 4 incident update.
MUJI customers should not assume that avoiding the app removes them from the scope of the incident. The company has identified online-store account use as a separate relevant category, so account holders should review their contact details, purchase records, saved payment methods, and any unusual communications that claim to come from MUJI or a card issuer.
Which MUJI Card data may have been accessed?
About 1.09 million MUJI Card accounts may have had their full card number, birth date, and MUJI Card ID accessed, Credit Saison says. The total includes active cards as well as cards that were already expired or closed. The issuer says about 345,000 potentially affected cards remained valid, while about 745,000 were no longer usable because they had been canceled or had expired.
The issuer says cardholder names, expiration dates, and security codes were not included in the potentially accessed MUJI Card data. That limitation is important, but it does not remove the need for account monitoring because the disclosed data set still includes a full card number and personal identifiers. Customers should use the information as a reason to verify transactions and issuer notices rather than as proof that fraud has occurred.
| Potentially affected information or group | What MUJI or Credit Saison disclosed | Practical response |
|---|---|---|
| MUJI Card accounts | About 1.09 million accounts may have had full card numbers, birth dates, and MUJI Card IDs accessed. | Review card activity and contact Credit Saison about replacement options. |
| Valid MUJI Cards | About 345,000 potentially affected cards remained valid. | Watch for unauthorized transactions and confirm replacement guidance with the issuer. |
| Expired or canceled MUJI Cards | About 745,000 potentially affected cards were no longer usable. | Remain alert for suspicious messages that use old account information. |
| MUJI online-store users | The affected group includes people who do not use the MUJI app. | Check online-store account details and do not rely on app use as the only exposure test. |
The MUJI Card disclosure is narrower than a claim that every payment credential was exposed, because Credit Saison specifically excluded names, expiration dates, and security codes from the potentially accessed card data. At the same time, customers should avoid sharing additional details with callers, texts, or emails that cite the breach, especially if the sender asks for a one-time code, password, or replacement-card fee.
Are MUJI Cards issued after August 2021 affected?
MUJI Cards issued from August 2021 onward are outside this incident, according to Credit Saison. The issuer says MUJI Card numbers stopped being shared with Ryohin Keikaku after a points-system change, which separates later-issued cards from the account data involved in the unauthorized access.
The August 2021 cutoff provides a useful starting point, but cardholders should still rely on direct issuer communications for their individual account status. A customer may have held more than one MUJI Card over time, and the disclosed population includes expired and canceled accounts. Credit Saison’s notice to MUJI Card holders is the appropriate source for replacement and monitoring information.
The most sensible approach is to check the issue date of each MUJI Card account and then compare that information with the issuer’s notice. Customers who cannot confirm a card’s issue date should contact Credit Saison through a trusted contact method obtained from the card, a statement, or the issuer’s official website. Do not use phone numbers or links included in unsolicited breach messages.
How serious is the MUJI data breach for customers?
The MUJI data breach presents a meaningful privacy and account-security concern because the November 4 disclosure adds potentially accessed card numbers and personal contact information to the earlier customer-data scope. Credit Saison says it has not confirmed data appearing on the dark web or an increase in fraudulent MUJI Card use, and it has increased transaction monitoring.
The absence of confirmed fraud is reassuring, but it is not a reason to ignore account activity. Breach-related messages can arrive after public disclosures, and personal information may make a message appear more credible. Customers should independently open the MUJI or card account instead of responding through links, attachments, or phone numbers sent in an unexpected alert.
Other recent incidents show why customers should separate a company’s notice from messages that imitate it. A saved card data exposure can create concerns beyond a single retail account, particularly when customers reuse contact details or credentials across services. The practical response is to verify communications through official channels and review financial activity directly with the card issuer.
What should affected MUJI customers do now?
MUJI customers should review MUJI Card transactions, check online-store account information, and contact Credit Saison if they want a replacement card. Credit Saison says it will reissue cards on request, while its transaction monitoring has been increased following the incident. Those steps address the active-card risk without requiring customers to wait for evidence of fraud.
- Review recent MUJI Card transactions and compare them with receipts or account history.
- Contact Credit Saison through an official contact method if a transaction is unfamiliar or a replacement card is needed.
- Check the email address, phone number, postal address, and saved payment information associated with a MUJI online-store account.
- Change the MUJI account password if it is reused on another service, and use a distinct password for the updated account.
- Ignore unexpected requests for passwords, verification codes, or payment details, even if a message refers to the MUJI breach.
MUJI customers should stop and contact Credit Saison immediately if they identify an unfamiliar transaction, cannot access a card account, or receive a replacement notice that conflicts with information shown in the official account. A customer should also contact the relevant financial institution rather than attempting to resolve a suspected unauthorized charge through an unverified email or text message.
How can MUJI customers avoid breach-related phishing?
MUJI customers can reduce phishing risk by treating unexpected breach notices as unverified until they are checked through an official MUJI or Credit Saison account. The disclosed data may include email addresses, phone numbers, names, and postal addresses for some people, which means a fraudulent message could contain personal details that make it seem legitimate.
MUJI customers should type the official website address into a browser, use a saved bookmark, or open the issuer’s official app or account page directly. Customers should not provide a password, card number, security code, or one-time verification code after following a link in an unsolicited message. A legitimate support process can be confirmed through a trusted contact route.
Password hygiene also matters after a breach involving account information. Customers concerned about reused credentials can apply the same careful approach used after a password reset incident: change reused passwords first, use unique credentials for important accounts, and confirm notices through the service’s actual sign-in page instead of an emailed link.
What is still unknown about the MUJI data breach?
The MUJI data breach disclosures do not establish that the potentially accessed records have been published, sold, or used fraudulently. MUJI and Credit Saison say they have not confirmed data on the dark web or an increase in fraudulent MUJI Card use. That distinction matters because potential access and confirmed misuse are different findings.
The incident timeline begins with unauthorized access at about 1 a.m. JST on October 29, according to Credit Saison. MUJI’s first public notice on October 30 described a possible exposure of up to approximately 27.26 million records, while the November 4 update identified a broader set of information and affected online-store users. An independent report on the expanded breach scope also describes the change in the companies’ disclosures.
The available notices also do not state that every affected customer has the same information at risk. MUJI says some records may include names, addresses, telephone numbers, and stored card information, while Credit Saison separately identifies the MUJI Card data categories. Customers should therefore follow the issuer’s account-specific guidance and continue monitoring rather than making assumptions based only on the largest published figure.
FAQ
Did the MUJI data breach expose full credit card numbers?
Yes, Credit Saison says full MUJI Card numbers may have been accessed for about 1.09 million accounts. The issuer says the potentially accessed card data also included birth dates and MUJI Card IDs, but did not include cardholder names, expiration dates, or security codes.
Are MUJI online-store users affected if they do not use the app?
Yes, MUJI says the affected group includes online-store users who do not use the MUJI app. Customers with a MUJI online-store account should review their contact details, saved payment information, and account communications.
Are MUJI Cards issued after August 2021 affected?
No, Credit Saison says MUJI Cards issued from August 2021 onward are outside this incident. The issuer says card numbers stopped being shared with Ryohin Keikaku after the MUJI points-system change.
Has MUJI confirmed fraudulent card activity from the breach?
No, MUJI and Credit Saison say they have not confirmed an increase in fraudulent MUJI Card use. Credit Saison has increased transaction monitoring, and customers should still review their account activity for unfamiliar charges.
Can affected MUJI Card holders request a replacement card?
Yes, Credit Saison says it will reissue MUJI Cards on request. Contact the issuer through a trusted official channel if you want a replacement card or see a transaction you do not recognize.