Muji Operator Says 1.09 Million Card Records May Have Leaked in Breach
Ryohin Keikaku says a breach may have exposed full numbers of about 345,000 active Muji Cards, widening an incident first disclosed Oct. 30.
About 1.09 million Muji Card records, including full card numbers and dates of birth, may have been accessed in an intrusion into the systems of Muji operator Ryohin Keikaku, the Tokyo retailer and card issuer Credit Saison said Wednesday.
Roughly 345,000 of those records belong to cards that are still valid, according to Credit Saison. The other 745,000 or so are cancelled or expired cards.
How the breach widened
Credit Saison said the unauthorized access took place at about 1 a.m. on Oct. 29. Ryohin Keikaku disclosed on Oct. 30 that email addresses, birth dates and gender of Muji app users may have leaked, and Kyodo News reported that the company put the number of possibly affected app records at up to 27.26 million.
In its second notice on Nov. 4, Ryohin Keikaku said the affected group also includes members of its online store who never used the app, and that names, addresses and phone numbers were exposed for some of them. Some credit card details that customers had saved in the app or online store may also have been accessed, the company said.
What the card data includes
The card numbers came from Muji Cards issued between October 2000 and July 2021, when Credit Saison shared them with Ryohin Keikaku so the retailer could award customer points. Ryohin Keikaku said that data had remained on its systems. Cards issued from August 2021 are not affected.
Cardholder names, expiration dates and security codes were not part of the card data, Credit Saison said. It said it has stepped up fraud monitoring, has not seen a rise in unauthorized use and will reissue cards on request.
Ryohin Keikaku said it has blocked the outside access, that the app and online store are operating normally, and that it has found no sign the data has appeared on the dark web or been misused. The company said it is contacting affected customers by email or mail.
The Straits Times reported that several other Japanese companies, including Bic Camera and Nomura Investor Relations, disclosed separate data leaks this week.
Developing: Ryohin Keikaku said it is still investigating the cause and full scope of the intrusion.
Sources: Ryohin Keikaku, Credit Saison, Kyodo News, The Straits Times.
Get the BURN VOC Briefing
Top US news in your inbox. Free.
This story is published by BURN VOC under its newsroom byline and follows our editorial standards. Sources are named in the story. To report an error, email news@burnvoc.com. Editorial Standards · Corrections · About BURN VOC
