> JapanHacked_
[Contained][Severity: Critical][Unknown]

Ryohin Keikaku: unauthorized access to the MUJI app may have exposed up to about 27.26 million records

Unauthorized access was found on Ryohin Keikaku's MUJI app, and up to about 27.26 million customer records, including former members, may have leaked.

Disclosed

2026-10-30

Organizations involved

1

Leaked or at risk

27.3M

27,260,000

Downtime

Unknown

What happened

  1. The company said it detected unauthorized access to the MUJI app and that customer data may have left its systems. [1] [2]

Impact

  • Up to about 27,260,000 records, including former members [1] [2]
  • Email addresses, birth dates and gender [1] [2]
  • Names, addresses, phone numbers and card data are not included. [1] [2]
  • No dark web leak or misuse is confirmed. [1] [2]

Response

The affected point was blocked and fixed. The app and online store work normally. [1] [2]

Timeline

  1. Disclosed 2026-10-30
  2. 1 days

Attack or cause

Method
[Unknown]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[E-mail address][Date of birth][Gender]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]無印良品の公式アプリ「MUJIアプリ」におけるお客さま情報流出の可能性についてRyohin Keikaku · 2026-10-30
  2. [2][News]無印良品、「MUJIアプリ」の利用者情報最大約2726万件が不正アクセスにより流出の可能性INTERNET Watch · 2026-10-30