Ryohin Keikaku: credential stuffing may expose purchase and points data in 270,000 MUJI store records

After strengthening monitoring following the first disclosure, Ryohin Keikaku identified mass login attempts using IDs/passwords possibly obtained illicitly outside the company. About 270,000 records may expose names, addresses, phones, emails, birth dates, gender and member IDs, plus purchase histories and points. Attack dates, a deduplicated person count and the source of credentials are not disclosed. [1]

This differs from access to member data and MUJI Card numbers in the original disclosure; the counts are not added. Store suspension from 16:00 on 6 November continues, with reopening delayed for additional safeguards. The company is preparing to require every user to reset passwords on reopening. Misuse of potentially exposed information is not confirmed in the fourth report. [1]