Ryohin Keikaku, the company behind Muji, announced on 30 October 2026 that unauthorised external access to its official MUJI App may have exposed customer information. The potential exposure covers up to about 27.26 million records, including customers who have since cancelled their membership. Nothing so far confirms that any of those records actually leaked outside the company, or that anyone misused them.
The honest version of this story is narrow: three fields only, no card details, no misuse confirmed by the company, and a very large ceiling. That combination is why the company’s phishing warning is the advice that fits this exposure.
What was exposed, and what was not
Only three items were in the potentially exposed data: email addresses, dates of birth, and customers’ genders. The company says the data did not include names, credit card details, addresses, or phone numbers. Former members are included in the ceiling, which means people who cancelled their Muji membership may still be in the potentially exposed set.
Two gaps matter for readers. First, no source states whether United States app accounts are included, or whether the affected app is the Japan app only; Muji operates stores in the United States, but that alone does not establish American victims. Second, the date the access happened and how the attacker got in have not been disclosed.
Why “may have” is doing heavy lifting
Our analysis puts the scale in context. The 27.26 million ceiling, in records, is about 721 times ANA’s same-day 37,800 customers and about 514 times Cathay Pacific’s roughly 53,000 bookings, a rough scale comparison across different headline units, not a like-for-like count of people. Against the same-day Japan figures cited in this article, the Muji ceiling is by far the largest, even though its data is far less sensitive per record.
The other side of the ledger is empty so far: the company had confirmed no misuse-related harm as of its notice, and no dark-web leakage had been confirmed by the company, against a potential ceiling of 27.26 million. That gap is why the headline must carry “may have”: a confirmed-leak headline would overstate what Ryohin Keikaku actually said.
Japan Cyber Watch’s running list of 2026 Japan breaches, updated on 30 October, counts 49 entries and places Muji’s figure as the third-largest of the year on its list. That is the site’s analysis, not a company or regulator ranking, but it underlines how large the ceiling is even among a year of big Japan disclosures.
The former-member detail deserves attention on its own. The ceiling includes people who cancelled their membership, who may no longer follow Muji announcements and may not connect a phishing email to an app they stopped using.
What Muji says it has done
After detecting the access, the company blocked access to the affected area and applied corrections. It apologised in a notice titled “Regarding the Potential Leak of Customer Information in Muji’s Official ‘MUJI App,'” and says it will contact potentially affected customers in sequence. It will make a further announcement if any external leakage is confirmed. The official app and online store continue to operate normally, and the company warned customers not to click links in suspicious emails.
I use the Muji app, what should I do?
Muji says only emails, birth dates and gender may have been exposed, with no names or card details, so the company’s stated concern is targeted phishing. Watch suspicious emails closely, never click their links, and wait for Muji’s notice to potentially affected customers before assuming you are affected.
- Treat every unexpected Muji email as suspect until you verify it inside the official app.
- Open the Muji app directly instead of clicking any link inside a suspicious email message.
- Treat any message asking for card details as suspicious, even though cards were not in the exposed data.
- Keep watching for phishing even if you cancelled your Muji membership, since former members are included.
- Wait for Muji’s notice to potentially affected customers before concluding your own data was exposed.
What to watch next
Three developments would change this story: confirmation of actual external leakage or misuse, the full official notice text with a detection date and any United States scope, and coverage from another major outlet beyond Reuters and Kyodo. Until one of those lands, the exposure stays potential, not confirmed.
Not connected to the Amadeus disclosures
Separate disclosures landed the same day: ANA reported about 37,800 customers affected through contractor Amadeus, and Japan’s Foreign Ministry reported about 3,600 records possibly compromised. Neither has been publicly linked to the Muji app incident, and no source links Muji to Amadeus or to the wider late-October cluster.
Sources
- Reuters wire via TradingView, 30 October 2026, report on the Ryohin Keikaku announcement, tradingview.com.
- Kyodo News, 30 October 2026, report on the Muji app potential leak, english.kyodonews.net.
- Biggo Finance, 30 October 2026, summary of the Ryohin Keikaku company announcement, finance.biggo.com.
- Dimsum Daily, 30 October 2026, report on the late-October incident cluster, dimsumdaily.hk (no shared origin between the late-October incidents, as reported).
- Japan Cyber Watch, updated 30 October 2026, analysis of 2026 Japan data breaches, japancyberwatch.com (running-list context, attributed analysis).
