MUJI Card Numbers Leaked: What Was Exposed and What to Do

Last checked: Nov 4, 2026. Based on Ryohin Keikaku and Credit Saison official notices.

On November 4, 2026, Ryohin Keikaku (the operator of MUJI) reported in a second notice that full MUJI Card numbers for about 1.09 million members may have been accessed by a third party around 1am on October 29, 2026. About 345,000 of those cards are currently valid.

This widened the scope from the company's first notice on October 30, which said card information was not included.

Here's what was leaked, who was affected, and what you should do if you have or had a MUJI Card.

#What data was exposed

According to Credit Saison's November 4, 2026 notice, the breach may have exposed the following information for about 1.09 million MUJI Card customers:

#What was not leaked

Credit Saison confirmed that:

• Card expiry dates were not included
• Security codes (CVV) were not included
• Credit Saison's own systems were not breached

The unauthorized access was to Ryohin Keikaku's system only. Ryohin Keikaku obtained card numbers from Credit Saison from October 2000 to July 2021 to give its own loyalty perks, and the company confirmed this information remained on its system.

#Who was affected

The affected group includes MUJI Card members who joined from October 2000 to July 2021:

• About 345,000 currently usable cards
• About 745,000 cards that are no longer valid (canceled, expired, etc.)

Cards issued from August 2021 onward are not affected because Ryohin Keikaku changed its system in July 2021 and no longer stores card numbers.

#How to check if you're affected

Your join date is shown in Credit Saison's member site:

1. Log in to Saison Portal or Net Answer
2. Go to Menu, customer information
3. Check your join date

If you joined from August 2021 onward, you're not affected. If you joined before that, follow the steps below.

#Why Ryohin Keikaku stored card numbers

From October 2000 to July 2021, Ryohin Keikaku obtained full card numbers, MUJI Card IDs, and dates of birth from Credit Saison to manage its own loyalty point program.

In July 2021, the company changed the mechanism so card numbers are no longer shared with Ryohin Keikaku. Cards issued from August 2021 are not included in this breach.

#Timeline of the breach

According to Ryohin Keikaku's second notice, further investigation showed the affected group also includes MUJI online store members (including people who don't use the MUJI app), some people's names, addresses, and phone numbers, and some card information.

As of November 4, 2026, no leak to the dark web and no misuse-related damage has been confirmed, according to Ryohin Keikaku.

#What to do if you're affected

If you have or had a MUJI Card issued from October 2000 to July 2021:

#1. Check your card statements

Check your Credit Saison statements for unfamiliar charges. If you see any, contact Credit Saison immediately.

#2. Request a card reissue if you're worried

If you're worried about the breach, you can ask Credit Saison to reissue your card with a new number. Keep in mind:

• It takes time for the new card to arrive
• Your old card will stop working once the new one is issued
• Any recurring payments linked to your card will need to be updated

#3. Watch for phishing

A card number without the expiry date and security code is harder to misuse for online purchases, but scammers can quote it in calls or emails to sound legitimate.

Never give your PIN, security code, one-time code, or full card number to anyone who contacts you by email, text, or phone. According to Ryohin Keikaku's notice, the company never asks for credit card information by email or phone.

Treat MUJI-themed emails, texts, and calls with links as suspicious. If you receive a message that mentions the breach, don't click links or open attachments. Go to the official MUJI or Credit Saison site yourself.

#4. If you're outside Japan

If you have a MUJI app or online store account but not a MUJI Card, your email address and date of birth may still be at risk. Watch for phishing emails that use your information to sound real.

#Response from Credit Saison

Credit Saison says it is:

• Strengthening monitoring for fraudulent use of affected cards
• Reissuing cards on request for worried customers
• Investigating and responding to unfamiliar charges reported by customers
• Contacting affected customers by email or post

The company reports no increase in fraudulent use has been confirmed so far.

#How the breach went viral

NHK's post about the breach on X (formerly Twitter) passed a million views within hours on November 4, 2026, showing how quickly news of data breaches spreads and how many people are concerned about their card information being accessed.

#Sources

All facts in this article come from the following sources:

• Ryohin Keikaku, "MUJIアプリにおけるお客さま情報の漏えいの可能性に関するお知らせとお詫び（続報）" (Nov 4, 2026)
• Credit Saison, "無印良品メンバー会員情報に関するお知らせ" (Nov 4, 2026)
• The Straits Times / Kyodo, "Credit card numbers may have leaked in cyberattack on Japan's Muji" (Nov 4, 2026)
• CNET Japan, "無印良品運営の良品計画、約1.09万件のカード情報が漏えいの可能性" (Nov 4, 2026)

#Keep your data off data brokers

Data breaches expose your information, but data brokers keep it circulating for years. Your name, address, and phone number can sit on people-search sites long after a breach.

UndoLeak erases your data from data brokers and keeps it off.

See where you're listed with a free scan.

---

Not affiliated with MUJI, Ryohin Keikaku, Credit Saison, or any company mentioned.