ENKR

Ryohin Keikaku MUJI app possible customer data leak

Add to my breach check

Made public · about 27.26 million records at most

What leaked3

Hard to replace

  • Email address

Permanent

  • Date of birth
  • Gender

To-dos

None of the harms this check covers.

What happened next8 events

  1. UndetectedNone on record
  2. Response 8 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record
  1. Began individual notices by email or post, together with Credit Saison
  2. No misuse of the credential-stuffing data found so far
  3. Raised records with name, address and phone from about 520,000 to about 750,000; about 440,000 cash-on-delivery recipients (January 2, 2020 to February 10, 2025) may also have leaked
  4. Found a credential-stuffing attack on the Net Store; about 270,000 more records may have leaked; Net Store reopening postponed
  5. Suspended the MUJI Net Store and all MUJI app functions except the member barcode
3 more
  1. Second notice, as reported by the press: Net Store customers, names, addresses and phone numbers added, and card numbers of about 1.09 million MUJI Card members may have been accessed
  2. By the notice date, blocked access to the affected part and applied a fix · press report
  3. Notice, as reported by the press: up to about 27.26 million email addresses, birth dates and genders from the MUJI app may have leaked
Company
Ryohin Keikaku
Made public
Notice
Possible leak
Affected
about 27.26 million records at most · approx., incl. customers who left · possible leak; company figure reported by the press

Sources