MUJI in Japan Also Hacked... 1.09 Million Customer Credit Card Numbers Leaked

Furniture retailer Nitori may also have leaked around 38 million customer records

The possibility that customers' credit card information was leaked has emerged at MUJI, a Japanese household goods retailer.

According to Kyodo News on Nov. 12, Ryohin Keikaku, which operates MUJI, said that as many as 1.09 million customers' credit card records may have been leaked.

A Muji store seen from outside. Photo by Bloomberg.

Ryohin Keikaku President Satoshi Shimizu apologized at a press conference in Tokyo that day, saying, "A vulnerability in part of our system meant we were unable to prevent the cyberattack." Ryohin Keikaku said that a third party had gained unauthorized access through a "credential stuffing attack," using IDs and passwords obtained from other internet services.

The credit card numbers that may have been leaked belong to customers who registered before July 2021. Excluding cards that had been canceled or expired, the number totals approximately 345,000. The company had not encrypted the credit card numbers, as required when storing them. "Credit card information that should have been destroyed was still on file," Shimizu said. "We will build a system to ensure that we do not retain unnecessary information."

Ryohin Keikaku will cover the full cost of reissuing credit cards whose information may have been exposed. It will also investigate whether the information was misused and discuss compensation individually if any damage is confirmed. Earlier, on Nov. 9, the company said that unauthorized access had occurred at MUJI stores and its e-commerce site, and that the names and postal codes of 440,000 customers who had received deliveries after making payments may have been leaked.

Earlier, on Nov. 9, the possibility that Japanese furniture retailer Nitori had been affected by a hack was also announced. Nitori Holdings said that unauthorized access may have exposed up to 37.62 million customer records, including buyers' names and addresses. However, Nitori reportedly suffered no leak of credit card information.

This content was produced with the assistance of AI translation services.