MUJI kept obsolete credit-card numbers without encryption

MUJI’s latest breach disclosure raises a question beyond how attackers entered: why was obsolete card data still there? At its November 12 briefing, operator Ryohin Keikaku acknowledged that retained card numbers had neither masking nor encryption. Their customer-identification role had ended in July 2021.[1]

The new disclosure concerns data handling, not a fresh November 12 intrusion. Card issuer Credit Saison dates unauthorized access to Ryohin Keikaku’s systems to October 29 and says it received the card-data warning on November 2. It found no corresponding intrusion into its own systems.[3]

TV Asahi reports that approximately 1.09 million complete MUJI Card number records may have leaked, including former members’ information. That is not a count of confirmed fraud victims or currently valid cards. Expiry dates and security codes were not included, according to the company. Cardholders have reason to watch for unfamiliar transactions, without assuming fraud has occurred.[2]

This is a data-retention failure rather than evidence of a revolutionary attack technique. Management says it will prioritize holding less information. Investigators have not established why deletion failed or conclusively established the exposure. Removing information after its purpose expires reduces what an eventual intruder could take.[1][2]

Updated: Beijing 2026-11-13 21:05; US Eastern 2026-11-13 08:05 EST.