Skip to content
JAENES
SSPossible leakNovember 4, 2026 announced

良品計画（MUJI／MUJI Card）Data breach / unauthorized access incident

笹尾 祐太朗の写真Reviewed by Yutaro SasaoWritten by Leak Watch editorial team published ・ updated
Occurred on
October 29, 2026
Announced on
November 4, 2026
Severity
SSLarge-scale compromise of sensitive data such as payment or identity-verification records affecting millions.
Scale
1,090,000 records
Main impact
It was announced that approximately 約109万件 of records — including full MUJI Card card numbers issued by クレディセゾン, MUJI Card IDs, birth dates, etc. — may have been accessed externally, and some records may also include names, addresses, and phone numbers.
Information involved
Card & payment dataUser / member IDDate of birthFull nameHome addressPhone numberEmail address
Cause / key point
It is believed that information may have been accessed externally due to unauthorized third-party access to 良品計画's systems.
Industry
Retail & e-commerce
Listing / capital
Listed company
Sources
Last updated
November 5, 2026

Where to go for this information

The steps themselves are on the protection guide. These links match the kinds of data in this incident, plus support contacts.

Ask AI about this incident

Opens an AI chat with this page's URL already in the prompt. Treat the answer as a starting point — always verify with the official sources listed above.

Ask ChatGPT ↗Search Perplexity ↗

Card & payment dataUser / member IDDate of birthFull nameHome addressPhone numberEmail addressHow severity is assessed →

Is this incident worth paying attention to?

Written & reviewed

笹尾 祐太朗の写真

Reviewed byYutaro SasaoFounder & CEO, MediaLeap Inc.

CEO of MediaLeap Inc. Working on both sides of web advertising and web media since 2013; founded the company in May 2025.

Review scope: cross-checking against primary sources (official and government announcements), verifying claims stay within the facts, and checking source attribution。Last reviewed:

Written by:Leak Watch editorial team (AI-assisted drafts verified against sources by the editorial team) · Reviewer profile · Request a correction

Related incidents

Browse the database →

Incidents sharing the same company, service, attack method or industry (grouped automatically from the disclosures).

Same attack method

Same industry

Attack method classification: Unauthorized access (method undisclosed)(Breached, but the technique was not identified or disclosed)

Read the Unauthorized access (method undisclosed) guide and national trends →

← Back to Breach Watch