The MUJI data breach in Japan has left plenty of Australian fans of the no-frills retailer wondering whether their own details are at risk. We went straight to MUJI’s official notices to separate what has been confirmed from what hasn’t.
The short version: the incident centres on MUJI’s official app and its Japanese online store, and so far MUJI has said nothing about customers in Australia. The Australian online store was trading as normal when we checked on 15 November 2026.
What happened in the MUJI data breach
On 30 October 2026, Ryohin Keikaku, the Japanese company behind MUJI, said it had detected unauthorised access from outside the business involving its official MUJI app.
It said up to about 27.26 million records, including those of former members, may have been exposed. At that stage the data was limited to email addresses, dates of birth and gender. The company said it had blocked access to the affected areas and applied a fix.
The MUJI data breach is wider than first thought
A second notice on 4 November widened the picture. MUJI said the affected records also cover members of its Japanese online store, including people who don’t use the app, and that some customers’ names, addresses and phone numbers were involved.
It also said some credit card information may have been accessed, both for MUJI Card holders and for customers who had saved a card in the app or online store. For people who signed up to the MUJI Card, a credit card issued by Credit Saison, before July 2021, this includes card numbers, MUJI Card IDs and dates of birth. MUJI said this information had remained on its systems.
The first notice had said no card details were involved, so this was a significant update.
MUJI paused its Japanese online store
MUJI suspended its Japanese online store, along with most features of the MUJI app, from 4pm on Friday 6 November, Japan time, to strengthen security. It said its shops were trading as normal.
On 9 November it postponed the reopening. In that notice, the company said third parties had made a large number of login attempts using passwords obtained elsewhere. This tactic is known as credential stuffing, and it may have led to accounts being accessed by someone other than their owners. MUJI also found unauthorised access to cash-on-delivery recipient details from 2 January 2020 to 10 February 2025.
MUJI said it would contact affected customers by email or post from 10 November, and plans to ask every customer to reset their password when the store reopens. No reopening date has been given.
Are Australians affected by the MUJI data breach?
None of MUJI’s notices mention Australia or customers outside Japan.
The Australian site, muji.com.au, carried no notice about the incident when we checked. It does display a separate warning about fake websites posing as muji.com.au, which is worth taking seriously at a time like this.
How to protect yourself after the MUJI data breach
Even if the MUJI data breach never touched your details, a few simple habits will keep you safer.
- Use a different password for every account. This is MUJI’s own advice, and it matters because credential stuffing only works when people reuse passwords.
- Be wary of emails, calls or texts claiming to be from MUJI. The company says it never asks for passwords or card numbers this way.
- Type muji.com.au into your browser rather than clicking links, given the fake-website warning on the Australian site.
- If you hold a MUJI Card, check your statements and contact the card issuer about anything you don’t recognise.
In brighter MUJI news
For Highpoint shoppers, MUJI Highpoint reopens at 10am on Thursday 19 November 2026, with snack and drink giveaways, a gift with purchase and limited-time offers running until 22 November.
Also read: Subclass 485 applicants face tighter rules for who travels with them
General information only, not legal advice. Check the official source before acting.
Sources: MUJI official notices · MUJI Australia.
