MUJI now says full card numbers of about 1.09 million MUJI Card holders may have been reached

On November 4, 2026, Ryohin Keikaku, the company behind MUJI, widened its account of the break-in it first reported on October 30. Credit card numbers are now involved. The company says about 1.09 million MUJI Card holders may have had their full card numbers and birth dates reached, and that the MUJI online store’s members are caught up too, not just app users. Kyodo News reported the numbers on November 5. This follows our first story on the MUJI app, so we cover only what is new.

What changed

Ryohin Keikaku’s November 4 notice (PDF, in Japanese) says that further analysis turned up three things:

1. The online store is included. The up to 27.26 million records, which can include email address, birth date, gender and member ID, belong to members of the MUJI app and the MUJI online store, including people who don’t use the app and people who have left. For about 520,000 of them, as things stand, names, addresses and phone numbers were also reached.
2. MUJI Card numbers were still on its systems. Until July 2021, the company received the card number, MUJI Card ID and date of birth of people who signed up for the MUJI Card, issued by Credit Saison, so it could give its own perks. That data was still in its system and was reached: about 1.09 million records, of which about 345,000 are cards that are still valid and the rest are expired or cancelled.
3. A small number of cards saved in the app or store. About 120 customers who saved a card in the app or online store had the first six and last two digits of the card number and the cardholder name reached.

The company says the card name, expiry date and security code weren’t included in the card data. It also says that, in its internal system, about 168,000 of the 345,000 valid cards could be linked with the email, birth date and gender data from the first group, and about 25,000 of those with names, addresses and phone numbers.

The Credit Saison side

Credit Saison, which issues the card, says in its own notice (in Japanese) that the intrusion was into MUJI’s systems, not its own, and that it has found no sign of unauthorized access to its systems or leaks from them. Its timeline:

• October 29, about 1 AM: someone accessed Ryohin Keikaku’s systems without permission.
• October 30: Ryohin Keikaku announced the app leak.
• November 2: Ryohin Keikaku told Credit Saison that MUJI Card numbers may have been reached too.

The card data covers people who joined the MUJI Card between October 2000 and July 2021, which is when Credit Saison shared card numbers with Ryohin Keikaku. It says card numbers aren’t shared any more, and that people who got a MUJI Card from August 2021 aren’t affected. Credit Saison says it has stepped up monitoring and sees no increase in fraud on MUJI Cards so far. It will reissue a card on request, and it says it will contact affected customers by email or post. Its MUJI Card line is 0120-227-190 (in Japan).

What isn’t known

Ryohin Keikaku says it hasn’t found the data on the dark web or any harm from its use. It hasn’t said how the intruder got in. It says the effect on its group results is expected to be limited.

What this means for you

A full card number with a birth date isn’t usually enough to pay online, because the expiry date and security code weren’t included. But a card number is a prized item for phishing: a fake "MUJI" or "Saison" message that quotes it will look real. If you ever had a MUJI Card, it might also be one of the records where the company can tie your card to your email and birth date.

What you can do

1. Check whether you had a MUJI Card before August 2021. Credit Saison says you can see your join date in the Saison Portal app or Net Answer, under the menu’s customer information.
2. Check your card statements for anything you don’t recognize, and report it to Credit Saison.
3. Ask for a new card if you want one. Credit Saison reissues it on request, through the same sites.
4. Don’t trust messages that quote your card number. Ryohin Keikaku says it doesn’t ask for card details by email or phone, and Credit Saison asks you not to enter card details on links in unexpected messages. Go to the official site yourself. See how scammers use leaked data.
5. Follow the steps in our first story about the email address and birth date leak, including two-step sign-in on your email account.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you sign up for store apps with an address of their own, so a leak at one store doesn’t reveal your main inbox. Frame never collects or stores the leaked records themselves.

Related coverage

• MUJI says emails and birth dates of up to 27.26 million app users may have leaked: our first story on this breach, from October 30.
• How scammers use leaked data to make phishing personal: why a quoted card number or birth date makes a fake message convincing.

Sources

• Ryohin Keikaku, 情報流出の可能性に関するお知らせ (PDF, via the Tokyo Stock Exchange, in Japanese), November 4, 2026
• Credit Saison, MUJI Card 会員情報の流出の可能性に関するお知らせとお詫び (in Japanese), November 4, 2026
• Kyodo News via Bangkok Post, Credit card numbers may have leaked in cyberattack on Muji, November 5, 2026
• ITmedia NEWS, 無印良品、クレカ「MUJI Card」カード番号全ケタ、約109万件漏えいか (in Japanese), November 4, 2026