MUJI Says Card Numbers May Have Been Accessed in a 1.09 Million-Record Cohort

Ryohin Keikaku and Credit Saison say full MUJI Card numbers may have been accessed in a roughly 1.09 million-record cohort. Here is what customers should check now.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

Translucent payment-card panel, shield and padlocks in front of a database, divided by a red-orange breach line and linked to profile-record tiles.
AI-generated editorial illustration of potential payment-card data access. Not official MUJI, Ryohin Keikaku, or Credit Saison imagery.

MUJI Says Card Numbers May Have Been Accessed in a 1.09 Million-Record Cohort12

Ryohin Keikaku and Credit Saison say a third party may have accessed full MUJI Card numbers and related customer information in Ryohin Keikaku’s systems.12 The notices describe potentially accessed records; they do not establish that every record was copied or misused.12

SECURITY NOTICE • Reporting cutoff: November 5, 2026, 2:35 AM EST / 2026-11-05T07:35:15Z

The bottom line

Credit Saison places about 1.09 million MUJI Card records in the potentially accessed cohort: about 345,000 currently usable cards and about 745,000 expired or cancelled cards.2

Verified facts

Potential card cohortAbout 1.09 million MUJI Card records, including inactive cards.2
Potentially accessible card fieldsFull card number, date of birth and MUJI Card ID; some records also included contact details.2
Not in that card datasetCardholder name, expiration date and security code were not included, Credit Saison says.2

What happened

Ryohin Keikaku’s November 4 second report expanded the potentially affected population beyond MUJI app users to include MUJI online-store users, including people who did not use the app.1 It says about 27.26 million records may have been affected.1

Why it matters

Who falls within the card cohort

Credit Saison says the MUJI Card cohort covers customers who joined from October 2000 through July 2021.2 It says cards issued from August 2021 onward are outside this cohort.2

Figure What it measures
About 1.09 million MUJI Card records that may have been accessed, including active and inactive cards.2
About 345,000 Currently usable cards in the potentially accessed cohort.2
About 745,000 Expired, cancelled or otherwise inactive cards in the cohort.2

What the companies say now

Ryohin Keikaku says it blocked the unauthorized external access, strengthened monitoring and had the MUJI app and online store operating normally at the cutoff.1 It said it had not confirmed publication of the customer information on the dark web or harm from misuse at the time of the notice.1 Credit Saison said it had not observed an increase in fraudulent MUJI Card use and had strengthened monitoring.2

What this means for readers

What MUJI Card customers should do

  • Check card statements: Credit Saison asks customers to review their statements and contact the issuer about transactions they do not recognize.2
  • Use official channels: If a message or call asks for card details, PIN or security code, do not enter information through the supplied link; check the official Credit Saison or Ryohin Keikaku site instead.2
  • Consider reissue: Credit Saison says it will accept reissue requests from customers who want a replacement card.2

What remains unknown

Actual access: The notices do not say how many records were actually viewed or removed; they define information that may have been accessed.12

Sources

  1. Ryohin Keikaku: 無印良品の公式アプリ「MUJIアプリ」におけるお客さま情報流出の可能性について（第二報） — November 4, 2026.
  2. Credit Saison: MUJI Card 会員情報の流出の可能性に関するお知らせとお詫び — November 4, 2026.

Update and correction note: This report is bounded to the cited company notices and the reporting cutoff.

Browse Articles

Latest Articles