Muji breach: up to 27.26 million MUJI app records may have leaked, including email addresses and dates of birth
Ryohin Keikaku announced on October 30, 2026 that unauthorised access to the official MUJI App may have leaked up to about 27.26 million records — email addresses, dates of birth and gender, including former members — and warned customers to watch for spoofing emails; names, addresses, phone numbers and card details were not included.
What happened
On October 30, 2026, Ryohin Keikaku, the company behind the Muji retail brand, announced that it had detected unauthorised external access to its official MUJI App and that some customer personal information may have been leaked. The company said that after detecting the access it blocked access to the affected systems and implemented corrective measures. It plans to notify affected customers in sequence, and said it will make a further announcement if external leakage is confirmed. This report is labelled POTENTIAL EXPOSURE because the company’s own wording is that the information “may have been leaked”: as of the announcement, no leakage of the information to the dark web or elsewhere, and no damage from misuse, had been confirmed.
Who is affected
Up to approximately 27.26 million records held in the MUJI App, including records of customers who have since closed their accounts — former members are affected as well as current ones. The information involved is three items only: email addresses, dates of birth and gender. The company was explicit about what was not included: no credit card details, no names, no addresses and no phone numbers were part of the potentially leaked data.
The MUJI App is the membership system that links Muji’s stores and its online shopping, which is why the record count is so large: the figure is a maximum, covering current members and people whose accounts are closed but whose records were still held. Ryohin Keikaku apologised in its notice “for the concern this has caused our customers and all related parties.” The company has not said how the unauthorised access happened or over what period it took place; those details, and whether any of the data actually left its systems, are the facts its promised further announcement needs to settle.
How serious
There is nothing here that directly empties an account: no passwords, no card numbers and no names were included. The concrete risk is targeted phishing. An email address paired with a date of birth and gender lets a scammer write a convincing fake Muji message — a “points expiring” or “verify your account” lure — and the same details are commonly used as identity-check answers elsewhere, so a date of birth given out in this leak can help an attacker pass weak verification on other services. Ryohin Keikaku itself warned that spoofing emails exploiting this information may circulate. The scale is what makes the incident matter: at up to 27.26 million records, it is one of the largest figures disclosed in Japan’s current run of app breaches.
What to do now
The company’s own warning is the starting point: it says spoofing emails exploiting this information may circulate, and asks users who receive suspicious emails not to click any embedded URLs or enter personal information. Because dates of birth change rarely and are reused as identity checks, the exposure does not expire when the news does — a record taken now can be used in a targeted message months later, which is why the caution below has no end date.
If you have ever used the MUJI App — including an account you closed — treat Muji-branded email with suspicion: do not click links or enter personal information from a message, and open the official app or website directly instead. Where you used the same date of birth as an identity answer on other services, stay alert for account-recovery or verification attempts you did not start. No password change is indicated by this disclosure, because no passwords were involved; the company says it will contact affected customers in sequence, so follow only instructions that arrive through its official channels.
Sources: BigGo Finance (company announcement report), October 30, 2026 · Reuters via TradingView, October 30, 2026