The disclosure

Ryohin Keikaku, the Japanese company behind the Muji brand, has said unauthorised external access to its official MUJI App may have exposed personal information covering up to about 27.26 million records.

The company announced the incident on 30 October 2026. The information potentially involved is limited to three items: email addresses, dates of birth and gender. That total is a maximum figure and includes people who have since closed their accounts, so former app users are also within scope.

What was not exposed, according to the company

Ryohin Keikaku says the potentially affected information does not include credit card details, names, addresses or phone numbers. It also says that, so far, it has found no confirmed leak of the information to the dark web or other channels, and no damage from misuse.

After detecting the unauthorised access, the company says it blocked access to the affected systems and put corrective measures in place. It plans to notify affected customers in sequence and to make a further announcement if any external leak is confirmed.

Why users should still be cautious

Even without names or card details, an email address combined with a date of birth can be used to make phishing messages look more convincing. The company has warned that spoofing emails exploiting this information may circulate, and it asks anyone who receives a suspicious message not to click embedded links or enter personal details.

The incident is the latest in a run of large Japanese app-related disclosures in October 2026, and it underlines a practical point for app users generally: closing an account does not always remove older records from a company's systems, so former users should take the same care as current ones.

Sources: Ryohin Keikaku (via BigGo Finance)