Ryohin Keikaku: 19,933 MUJI made-to-order curtain records with names and addresses may have leaked via a subcontractor
A subcontractor's server for MUJI made-to-order curtains was accessed on 19 October; 19,933 records of 2018 to 2022 orders with names, addresses and phone numbers may have leaked.
Disclosed
2026-11-02
Organizations involved
2
Leaked or at risk
19.9K
19,933
Downtime
Unknown
What happened
A server managed by Nanotec, the system subcontractor, was accessed from outside. [1]
Nanotec found the traces and reported them to Ryohin Keikaku through MN Inter-Fashion. [1]
Ryohin Keikaku announced the incident. [1]
Impact
Names, addresses, phone numbers, order details and delivery addresses in 19,933 records (some customers appear more than once) of MUJI made-to-order curtain orders from 10 April 2018 to 25 January 2022 may have leaked. Card data and email addresses are not included. [1]
Current orders run on a different server, where no problem has been found. The company treats this separately from Ryohin Keikaku: MUJI app intrusion, announced on 30 October. [1]
Timeline
- Detected 2026-10-28
- Disclosed 2026-11-02
- 5 days
Attack or cause
- Method
- [Intrusion]
- Impact
- [Data leak]
- Entry point
- Supplier
Data exposed or at risk
Supply chain
- Organizations listed on this site
- 2
Organizations involved
[Through a supplier][Major]Tokyo, BunkyoWholesale and retail trade19,933 leaked
Ryohin Keikaku Co., Ltd.Outsourced its made-to-order curtain work to MN Inter-Fashion.
[Through a supplier][Major]Tokyo, MinatoWholesale and retail trade19,933 leaked
MN Inter-Fashion Ltd.Outsourced system work to Nanotec, whose server was breached.
Sources
- [1][Official]オーダーカーテンに関するお客さま情報の流出の可能性についてRyohin Keikaku · 2026-11-02