Ryohin Keikaku, the operator of Muji, has postponed the reopening of its online store, which it suspended on Friday 6 November. In a disclosure dated 9 November 2026, the company said a "list-type attack" (a large run of login attempts using passwords that may have been obtained elsewhere) may have let third parties log in to accounts that were not theirs. It said the attack came while it was already watching the system more closely.
This adds to the Earlier Tokyo Brief coverage of the suspension. The company gave no reopening date. It said it will announce one after completing "necessary measures and checks".
Who may have been exposed
Ryohin Keikaku lists four groups whose data may have been accessed from outside, and says some of the counts it announced earlier have changed. The disclosure gives approximate figures. The first group, users of the Muji app and online store, includes people who have since left the service.
| Group | Information that may have been accessed | Approximate count |
|---|---|---|
| Muji app and online store users (including former members) | Email address, date of birth, gender, member ID | 27.26 million |
| Subset of the above | Plus name, address, phone number | 750,000 |
| Further subset, per the table's third tier | Plus purchase history and points | 270,000 |
| Muji Card holders (Credit Saison), joined by July 2021 | Full card number, Muji Card ID, date of birth | 1.09 million records (about 345,000 currently valid cards) |
| Customers who registered a card in the app or online store | First six and last two card digits, cardholder name | 120 |
| Cash-on-delivery recipients, orders received 2 January 2020 to 10 February 2025 | Recipient name, recipient postal code | 440,000 |
The company says it has confirmed unauthorized access to part of the information on cash-on-delivery recipients, a group added in this update. The table covers data that may have been accessed. The company does not say it has confirmed that any data was extracted.
What the card data does and does not include
For Muji Card holders, who joined by July 2021, the exposed fields include the full card number. The card is issued by Credit Saison. The company says cardholder name, expiry date and security code are not included. About 1.09 million card records are involved, but only about 345,000 are currently valid cards. The remainder are cards that have already expired or been cancelled.
The company adds that, in its internal systems, about 168,000 of the valid cards could be viewed alongside the basic account information in the first tier, and about 25,000 of those alongside the name, address and phone number tier.
For the roughly 120 customers who registered a card in the app or online store, only the first six and last two digits and the cardholder name are involved. Expiry date and security code are not.
Ryohin Keikaku says it has not confirmed any damage from misuse of the information that may have been viewed.
What happens next
The company will begin contacting affected customers individually on 10 November 2026, by email or post. Credit Saison will also contact customers. The company apologised for the delay in notifying them.
When the store reopens, the company is preparing to ask all customers to reset their passwords. It asks customers who use the same email and password across several services, which raises the risk of unauthorized login, to set a different password for Muji. It also says it never asks customers for passwords or card numbers by email, phone or text message.
On earnings, Ryohin Keikaku expects "a certain impact" from the suspension but says the amount is under review, and it will disclose further matters promptly. It is still working to establish the cause and scope of the incident.