Muji Operator Suffers Massive Data Breach Due to Retained Credit Card Records
Ryohin Keikaku confirms unauthorized access exposed millions of customer records and credit card data.
1Security Breach at Muji
Ryohin Keikaku, the operator of the Muji retail chain, recently confirmed a significant data breach involving unauthorized access to its systems. The incident, detected on October 29, potentially compromised up to 1.09 million credit card records. President Satoshi Shimizu publicly apologized, acknowledging clear shortcomings in the company's internal data management practices.
2Failure to Purge Data
The investigation revealed that the company failed to delete full credit card numbers despite an existing policy requiring their removal. These numbers were originally used to identify customers for rewards until July 2021. The company continued to store this sensitive information unnecessarily, creating a major vulnerability that attackers eventually exploited during the breach.
3Scope of Compromised Records
Beyond the credit card data, the breach affected a much larger volume of customer information. Ryohin Keikaku estimates that up to 27.26 million customer records, including registered email addresses, may have been exposed. The company is currently investigating whether the retention of the credit card numbers was an intentional act or oversight.
4Credential Stuffing Attacks
In addition to the primary data leak, approximately 270,000 member accounts were targeted by credential stuffing attacks. In these incidents, attackers use login combinations leaked from other companies to gain unauthorized access to Muji accounts. This highlights the risks associated with password reuse across different platforms in the current digital security landscape.
5Immediate Operational Response
As a direct security measure following the detection of the unauthorized access, Ryohin Keikaku suspended its online store operations starting Friday. This move aims to prevent further unauthorized activity while the company conducts a thorough investigation into the breach. The store remains offline as security teams work to secure the compromised infrastructure.
6Corporate Accountability Measures
President Satoshi Shimizu emphasized that the company must feel a deep sense of responsibility regarding the incident. The firm is now under pressure to explain why its internal policies for data deletion were not followed. Management is currently cooperating with ongoing investigations to determine the full extent of the security failure's impact.
7Data Retention Risks
This incident serves as a stark reminder of the dangers inherent in retaining legacy customer data. By keeping full credit card numbers long after they were needed for identification, the company maintained a high-value target for cybercriminals. Proper data lifecycle management remains a critical component of modern retail security and consumer trust.
8Future Security Outlook
The breach highlights the evolving threats facing global retail chains, particularly regarding the protection of historical customer data. As Ryohin Keikaku continues its investigation, the focus will likely shift toward implementing more robust automated deletion protocols. Ensuring that security policies are strictly enforced is essential to preventing similar large-scale data exposures moving forward.