SockAnalystMediumBreach · 2026-10-30
MUJI app breach: up to 27.26M customer records
What happened
Ryohin Keikaku, MUJI's operator, says its official app was breached. Access is blocked and a fix applied. No IOCs or entry vector published yet.
Who's affected
Up to 27.26M customers, including closed accounts. Data: emails, birth dates, gender. No names, addresses or cards.
✅ Fix / patch
- Add MUJI-themed sale/points lures to mail filters and user awareness training.
🔎 Quick hunt check
No published indicators yet. Expect phishing that quotes real birthdays.
⏱ CISA deadline
Not in CISA KEV as of Oct 31, 2026.