Muji (Ryohin Keikaku) — cyberattack exposed >1 million customer credit card numbers including former members
Severity: high · Patch status: no-fix-needed · Since 2026-11-12
Ryohin Keikaku, the operator of the Muji retail chain, disclosed a cyberattack that breached customer data, including more than one million credit card numbers. President Shimizu Satoshi publicly apologized, noting the compromised data also includes records of former members. Details on the intrusion vector, exact dates, and whether payment data was encrypted are not stated in the source. The incident makes Muji one of several recent Japanese companies hit by cyberattacks. Affected customers face potential card fraud and should monitor accounts; the company is presumably notifying affected individuals and working with authorities, but no remediation specifics are given.
What to do
- Monitor payment card statements for fraudulent charges and request card reissue if you shopped at Muji or held a Muji membership
- Watch for phishing emails or messages impersonating Muji referencing the breach
- Check whether Ryohin Keikaku offers identity or credit monitoring and enroll if eligible
- Review Ryohin Keikaku's official notices for scope, timelines, and guidance
- Organizations processing card data: verify PCI DSS compliance and review payment-system access controls
Sources
All live incidents on Threat Watch
