Muji operator fails to delete unnecessary credit card data

Ryohin Keikaku, the operator of the Muji retail chain, said Thursday that the company’s failure to delete unnecessary customer credit card information was a factor behind a data breach involving up to 1.09 million credit card records through unauthorized access.

“We must feel a deep sense of responsibility,” Ryohin Keikaku President Satoshi Shimizu said at a news conference. “There were shortcomings in our data management.”

Ryohin Keikaku had retained full credit card numbers of its “Muji Card” credit cards, which it used to identify customers when granting rewards until July 2021, when it switched to using other information for identification. The company continued to retain the data despite adopting a policy of deleting full credit card numbers.

The company said it is continuing to investigate the matter, as it remains unclear whether the data retention was intentional.

Ryohin Keikaku detected unauthorized access on Oct. 29. It believes that up to around 27.26 million customer records, including the email addresses of registered users, may have been compromised.

In addition, around 270,000 member accounts were targeted by credential stuffing attacks, in which attackers attempt to log in to accounts using combinations of IDs and passwords exposed in data breaches at other companies. The Muji operator has suspended its online store since Friday as a security measure.