MUJI says cyberattack exposed 1.09 million full card numbers

Ryohin Keikaku, the Japanese company behind the MUJI retail chain, said on 4 November that attackers who broke into its systems may have reached the full card numbers of about 1.09 million holders of the MUJI Card, a credit card issued by Credit Saison. About 345,000 of those cards are still valid. Five days earlier the company had said no card details were involved. The new figures are in a second notice and a filing to the Tokyo Stock Exchange.

The exposed card records hold the full card number, the MUJI Card ID and the date of birth. They do not include the cardholder's name, the expiry date or the security code, the company says. They belong to members who joined by July 2021: until then, Ryohin Keikaku collected those details to give MUJI Card holders its own perks, and the data stayed on its systems.

What changed since 30 October

On 30 October the company said unauthorised access to the MUJI app may have exposed the email addresses, dates of birth and gender of up to about 27.26 million customers, including people who had closed their accounts. It said then that card details, names, addresses and phone numbers were not involved.

The 4 November notice adds:

• The 27.26 million records also cover members of MUJI's Japanese online store who never used the app, and the member ID is exposed as well.
• About 520,000 of those records also include a name, postal address and phone number.
• For about 168,000 of the 345,000 valid card numbers, the attackers could also see the customer's email address, date of birth and gender, and for about 25,000 of those, the name, address and phone number too.
• About 120 customers who saved a card in the app or online store had the first six and last two digits of the card number and the cardholder name exposed.

The company says it blocked the access, has found no sign of the data on the dark web and no misuse so far, and is still working out the cause and the full scope. It has not said how the attackers got in or when the access started. The app and online store are running normally, and it expects a limited effect on its results, it told the exchange. NHK and ITmedia reported the new figures.

What customers should do

Ryohin Keikaku says it will contact affected customers by email or post, and Credit Saison will contact MUJI Card members the retailer has no contact details for. Credit Saison has stepped up fraud monitoring on MUJI Cards and will reissue a card on request. The company asks customers to check their card statements and report unknown charges to their card issuer, and to watch for emails and calls pretending to be MUJI or a card company. It says it never asks for card details by email or phone.