MUJI’s parent company warned Friday that up to approximately 27.26 million customer records associated with its official app may have leaked following unauthorized external access.
Ryohin Keikaku said the potentially exposed information includes email addresses, dates of birth and gender. The total includes records belonging to customers who have closed their accounts. It is a count of records, not a confirmed count of individual people whose information was stolen.
The retailer said credit card information, customer names, physical addresses and telephone numbers are not included in the information identified as potentially exposed.
In its October 30 notice, the company said it detected unauthorized external access, blocked access to the affected area and applied fixes. The MUJI app and the company’s online store remain available for normal use.
The company has not confirmed that the information appeared on the dark web or that it was misused. Its notice describes a possible external leak, rather than confirmed theft of all the records covered by the warning.
Ryohin Keikaku said it will contact customers whose information may have leaked and issue a further announcement if an external leak is confirmed.
The company warned that the potentially exposed information could be used in impersonation emails. It urged customers not to click links or enter personal information through suspicious messages.
The disclosure does not give an intrusion date, identify an attacker or name a cause for the unauthorized access. It also does not specify which countries’ customers are covered by the maximum record count.
Ryohin Keikaku said it would continue strengthening security and monitoring with its development and related companies, and apologized to customers and others affected by the concern.
JBizNews Desk | Tokyo
© JBizNews.com. All rights reserved. Unauthorized reproduction or redistribution is strictly prohibited.
