Breach · · 3 min read
MUJI says emails and birth dates of up to 27.26 million app users may have leaked
MUJI’s parent company says an intruder may have taken email addresses, birth dates and gender from its MUJI app. Names, addresses, phone numbers and cards weren’t included.
Ryohin Keikaku, the company behind the MUJI stores, said on October 30, 2026 that customer information from its official MUJI app may have leaked after someone accessed it without permission. The notice covers up to about 27.26 million records, including people who have already deleted their accounts. If you’ve ever used the MUJI app, here’s what the company has said.
What happened
According to Ryohin Keikaku’s notice (in Japanese), it detected unauthorized access from outside, blocked access to the affected part of its systems and applied a fix. It then confirmed that some of the customer information it holds for the MUJI app may have leaked. The information that may have leaked is:
- email address
- date of birth
- gender
The company says credit card details, names, postal addresses and phone numbers aren’t included. It says it hasn’t found the information on the dark web or any harm from its misuse so far. It hasn’t said how the intruder got in, and the notice doesn’t say whether people who use MUJI apps outside Japan are included.
Ryohin Keikaku says it will contact customers whose information may have leaked in turn, and will announce it if a leak is confirmed. The MUJI app and the MUJI online store are working normally. Internet Watch (in Japanese) and Kyodo News reported the same details.
What this means for you
An email address with a birth date isn’t enough to get into your accounts, but it’s enough for a convincing fake message: one that greets you, mentions a birthday reward or a points problem, and asks you to “confirm” your details. The company itself warns that emails pretending to be MUJI may follow.
What you can do
- Be wary of emails that claim to be from MUJI, especially ones about birthday coupons, points or account problems. Don’t click links or enter personal details from them. Open the app yourself instead.
- Check your MUJI app password. Passwords weren’t listed as affected, but if you used the same one anywhere else, now is a good time to give each account its own.
- Turn on two-factor sign-in for your email account, since that’s the address the leak points to.
- If something looks wrong, Ryohin Keikaku’s customer line in Japan is 0120-64-0772 (Monday to Saturday, 9:30 to 17:00 Japan time).
- Learn the patterns. See how scammers use leaked data.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame’s email aliases also let you sign up for store apps with an address of their own, so a leak at one store doesn’t reveal your main inbox. Frame never collects or stores the leaked records themselves.
Sources
- Ryohin Keikaku, 無印良品の公式アプリ「MUJIアプリ」におけるお客さま情報流出の可能性について (in Japanese), October 30, 2026
- Internet Watch, 無印良品、「MUJIアプリ」の利用者情報最大約2726万件が不正アクセスにより流出の可能性 (in Japanese), October 30, 2026
- Kyodo News, ANA says data on 37,800 customers leaked in hacking, October 30, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.