Overview
The notice gives "up to approximately 27.26 million" records (including former members); this is not a confirmed figure, so the count is left blank. Names, addresses, phone numbers and card data are stated not to be included. No dark-web exposure or misuse had been confirmed at the first report.
Timeline
- Occurred
- Discovered
- Disclosed
Organization response
Access to the affected component was blocked and fixed; affected customers are to be contacted.
What you can do
Be wary of emails, SMS or calls impersonating the organisation; do not open links or attachments or enter passwords or card details. Change reused passwords on other services.
Sources
- 無印良品の公式アプリ「MUJI アプリ」におけるお客さま情報流出の可能性について（第一報）株式会社良品計画 · 2026-11-09