Muji warns 1.09 million records leaked; full card numbers for 345,000 at risk

Ryohin Keikaku, the operator of the Muji brand, said on Nov 4 that about 1.09 million customer records may have leaked through unauthorised access to its systems. Roughly 345,000 of those Muji Card records contain the full numbers of currently valid credit cards, along with dates of birth. That is not a drill-and-reassure disclosure; that is live card data sitting in someone else's hands.

The Nov 4 announcement lands on top of a separate October report from the same company, in which it admitted that up to 27.26 million customer records may have leaked following unauthorised access to the Muji App. Two incidents, two months, one retailer. Nobody has yet explained whether the two breaches share a root cause, but the question is now unavoidable.

What does the wider breach wave look like?

Muji is not the only Japanese name counting records this week. On the same morning, Nomura Investor Relations, a subsidiary of Nomura Holdings, disclosed a breach of Institutional Navi, its information service for institutional investors and analysts. The service distributes corporate earnings briefing information and supports attendance management.

Unauthorised access was detected on Nov 2 and confirmed as a data breach the following day. The leaked material may include names and e-mail addresses. Nomura Investor Relations has not disclosed how many records were affected. It has suspended Institutional Navi and, as a precaution, also pulled an information service for individual investors that runs on the same server while it checks that platform for intrusions.

The common thread elsewhere is a single contractor. On Nov 2, electronics retailer Bic Camera said about 14.9 million customer records, including e-mail addresses, may have leaked through unauthorised access at Arara, the contractor that runs its e-mail newsletter distribution. The affected data possibly covers customers of Bic Camera and its subsidiaries, Kojima and Sofmap. No credit card information or online shopping login credentials were included, the retailer said, and no secondary damage has been confirmed so far.

Arara's e-mail system also dragged in three more clients:

• Airdo, the Sapporo-based regional airline on Hokkaido, said on Nov 4 that 673,920 e-mail user records had leaked.
• Solaseed Air, based in Miyazaki on Kyushu, said up to 490,000 e-mail addresses had leaked.
• Workman, the workwear producer, said up to 1.45 million e-mail addresses may have leaked.

Both airlines stated that credit card information and names were not compromised. In the Arara-linked cases, no credit card details have been confirmed.

What does this change for CIOs?

Three practical lessons sit in the numbers. First, card data still flows through marketing and loyalty systems: Muji's incident exposed full numbers on 345,000 valid cards, which suggests storage practices that many security teams assumed were retired a decade ago. Second, a newsletter contractor became the single point of failure for at least five brands and more than 17 million e-mail addresses combined. Third, Nomura's decision to suspend a service running on the same server as the breached one is the textbook move — isolate first, assess second, disclose with what you know.

The disclosure pattern also matters. Detection on Nov 2, breach confirmation on Nov 3, public announcement on Nov 4 is a fast cadence by any market's standards. Whether the affected customers regard speed as consolation is another matter entirely.