MUJI (Ryohin Keikaku) Data Breach
Ryohin Keikaku Co., Ltd., the Tokyo-based operator of lifestyle and retail brand MUJI, disclosed on October 30, 2026, that its official MUJI App in Japan had suffered unauthorized external access.
Exposed Data Types
3- Email addresses
- Dates of birth
- Genders
About This Breach
Internal forensic checks revealed that up to 27,260,000 customer records, spanning both active app members and former users who had previously canceled their accounts, were potentially exposed during the intrusion.
The accessed dataset primarily contained email addresses, dates of birth, gender markers, and internal member identifiers. Ryohin Keikaku confirmed that full names, physical street addresses, login passwords, and credit card details were not stored on the affected system and remained uncompromised while engineers patched the underlying vulnerability.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
