Key takeaways

  • Ryohin Keikaku, which runs MUJI, said on October 30 that email addresses, birth dates and gender of up to 27.26 million MUJI app users may have leaked, and that card details, names and addresses were not included.
  • Its second report on November 4 changed that. The 27.26 million also covers online store customers, about 520,000 of them with names, addresses and phone numbers, and the attackers may have reached full card numbers of about 1.09 million MUJI Card credit cards, about 345,000 of them still valid.
  • The card numbers came from the card's issuer, Credit Saison, which passed them to MUJI from 2000 to July 2021 so that MUJI could give points for card use. MUJI changed the scheme in 2021, but the numbers stayed in its systems.
  • No holder names, expiry dates or security codes were included. But for about 168,000 valid cards, the numbers sat alongside the holders' email addresses and birth dates, and for about 25,000, alongside names and addresses.
  • The attack began around 01:00 on October 29, according to Credit Saison. MUJI has still not said how the attackers got in.

What happened#

According to Credit Saison, a third party gained unauthorized access to Ryohin Keikaku's systems at around 01:00 on October 29. MUJI detected the access, blocked it and applied a fix, and on October 30 said customer data from the MUJI app may have leaked: email addresses, birth dates and gender of up to 27.26 million customers, including people who had left. It said card information, names, addresses and phone numbers were not included.

Further analysis found more. On November 2, MUJI told Credit Saison that card numbers it had once received were also among the data that may have been accessed. On November 4, it published a second report and a stock exchange filing.

MUJI says the app and the online store are working normally, that it has found no posting of the data on the dark web and no misuse, and that it will contact affected customers by email or post. Credit Saison will contact MUJI Card holders whom MUJI cannot reach.

What may have been accessed#

Group Data Count
MUJI app and online store customers, including former members Email address, birth date, gender, member ID Up to about 27.26 million
Some of the above Also name, address and phone number About 520,000 (so far)
MUJI Card holders who joined between October 2000 and July 2021 Full card number, MUJI Card ID, birth date. No holder name, expiry date or security code About 1.09 million (about 345,000 still valid; about 745,000 expired or cancelled)
Customers who saved a card in the app or online store First six and last two digits, holder name About 120

In MUJI's systems, about 168,000 of the valid card numbers could be viewed together with the holder's email address, birth date and gender, and about 25,000 of those also with name, address and phone number.

Why MUJI had card numbers#

Credit Saison explains it. From October 2000 to July 2021, it passed MUJI Card numbers and birth dates to Ryohin Keikaku so that MUJI could award points to customers who used the card. The point scheme was then changed, and Credit Saison no longer sends card numbers. Cards issued from August 2021 are not affected.

So MUJI held these numbers for one purpose, stopped needing them for that purpose more than five years ago, and kept them anyway. Ryohin Keikaku says only that the data "remained" in its systems.

What to do if you are affected#

  • MUJI Card holders who joined by July 2021: check your statements. Credit Saison has stepped up monitoring and will reissue the card on request. Your join date is shown in Saison's member services.
  • App and online store customers: expect convincing phishing that uses your email address, birth date and, for some, your name and address. MUJI and Credit Saison say they will never ask for card details by email or phone.
  • See our guide on what to do after a breach notice for each kind of leaked data.

A second, separate leak#

On November 2, MUJI disclosed a different incident. Its made-to-order curtain service is run by MN Inter-Fashion, which in turn uses a system company, Nanotech. A Nanotech server was accessed on October 19, and names, addresses, phone numbers and order details from 19,933 curtain orders placed between April 2018 and January 2022 may have leaked. That is a vendor two steps removed from MUJI, holding orders up to eight years old.

What we don't know yet#

  • How the attackers got in on October 29, and which system they reached. MUJI's first report mentioned the help of the app's developer and related companies
  • Why the first report said card data, names and addresses were not included
  • Whether the expired and cancelled card numbers, about 745,000, had any use at all after 2021
  • Whether other data from old schemes is still kept

Our view#

Why did MUJI keep card numbers at all? The point scheme needed a way to link card use to a MUJI member. A card number did that, but so could the MUJI Card ID that was passed with it, or an identifier from the card issuer. Even if the full number was needed in 2000, it stopped being needed when the scheme changed in 2021. Five years later, about 1.09 million numbers were still there, including about 745,000 for cards that no longer work. In our view, that is the core failure here: data that had lost its purpose was never deleted.

Changing a scheme should include deleting its data. When a business process ends, the data collected for it rarely goes with it, because nobody owns the clean-up. This is the same problem we saw with GMO Trust Login's temporary files and with Times Car's ID images: data nobody needed any more, kept by default. Ending a scheme should come with a decision on what happens to its data and a record that it was done.

Card data outside the payment flow still counts. Since the 2018 amendment of the Installment Sales Act, merchants that accept cards must protect card numbers, and the industry's guidelines treat not retaining them, or meeting PCI DSS, as the way to do so. These numbers did not come from MUJI's checkout; they came from a co-branded card partner for a loyalty scheme. How the rules apply to data like this is for the regulators to say, but for the cardholder the risk is the same, and the data deserved the same care.

The first notice understated the case. On October 30, MUJI said card details, names and addresses were not included. Five days later, all three were. First notices are often incomplete, and saying so is better than waiting. But a categorical "not included" in a first report should be reserved for what has actually been checked.

What this means for practitioners#

  • Inventory data received from partners. Co-branded cards, loyalty schemes and integrations bring in data that your own systems did not create and your own teams may not track.
  • Tie retention to purpose. When a scheme or integration ends, delete the data it collected, or document why it must stay.
  • Use tokens or IDs instead of card numbers for loyalty and linking, wherever the card issuer can provide them.
  • Treat card numbers as card data wherever they live, not only in payment systems.
  • Be careful with "not included" in first notices. State what has been confirmed and what is still being checked.

Japanese terms at a glance#

Japanese Reading Meaning
良品計画 Ryōhin Keikaku The company that runs MUJI
第二報 dai ni hō Second report
外部からアクセスされた可能性 gaibu kara akusesu sareta kanōsei May have been accessed from outside
カード番号（全ケタ） kādo bangō (zen keta) Full card number
有効期限 yūkō kigen Expiry date
セキュリティコード sekyuriti kōdo Security code (CVV)
特典 tokuten Perk, benefit
連携 renkei Data sharing between companies
再発行 saihakkō Card reissue
非保持化 hihojika Not retaining card data