MUJI Data Breach Expands, Online Store Reopening Delayed

Ryohin Keikaku, the parent company of MUJI, announced a significant expansion of a previously disclosed data breach, potentially affecting 2.726 million customers who use the MUJI app or online store. The breach now includes the possible compromise of email addresses, dates of birth, gender, and membership IDs, and for approximately 750,000 customers, also includes names, addresses, and phone numbers. Roughly 270,000 customers are also potentially affected by unauthorized logins utilizing credentials obtained elsewhere.

In addition to the customer data, the breach extends to approximately 1.09 million MUJI Card holders (issued by Credit Saison), including full credit card numbers for those who enrolled up to July 2021. While cardholder names, expiration dates, and security codes were not compromised, the exposure of full card numbers—and for a subset of cardholders, associated personal information—represents a substantial risk. The company also confirmed unauthorized access to information related to approximately 440,000 customers who used cash-on-delivery services between January 2, 2020, and February 10, 2025, including delivery names and postal codes. The company stated that as of the time of the filing, no instances of misuse of the data had been confirmed.

The company is delaying the reopening of its online store, initially paused on November 6th, to implement further security measures. Ryohin Keikaku intends to require all customers to reset their passwords upon the store’s eventual reopening. The company anticipates that the temporary shutdown will impact its financial results, but is still assessing the extent of the damage. The filing states that the company is investigating the cause and scope of the breach, and will make further disclosures as needed. This breach represents a material operational and financial risk for Ryohin Keikaku, and its handling of the situation will be closely watched by investors and customers alike, especially as similar breaches continue to occur with increasing frequency.

Ryohin Keikaku has consistently identified and addressed climate-related risks in its annual reports, and has set a goal to reduce its GHG emissions by 50% by 2030 (compared to fiscal year 2021). However, the company's current disclosure focuses on the immediate concern of cybersecurity risks and their potential impact on customer data and financial performance. The company's ability to regain customer trust and secure its systems will be critical in mitigating further damage.