On November 12, Muji Co., Ltd. (located in Bunkyo Ward, Tokyo), which operates the "MUJI" brand, held a press conference regarding the potential leakage of customer information due to unauthorized access, and President Masahiro Shimizu and others apologized. Regarding the issue of not deleting all digits of previously obtained credit card numbers, the company explained, "There was a problem in the operation and management of the data. It was our fault."
On October 30, the company announced the possibility of unauthorized access to customer information, including up to approximately 27.26 million pieces of data from official apps such as the "MUJI App." Initially, credit card information was not considered as part of the affected data, but on November 4, it was announced that approximately 1.09 million customers who joined the MUJI Card between October 2000 and July 2021 may have had their full credit card numbers accessed from the outside.
According to the announcement on November 4, the credit card numbers were obtained for the purpose of providing unique benefits to MUJI Card members. In July 2021, the company changed the system used for providing benefits and ceased linking credit card numbers. However, some of the credit card numbers obtained before the change were not deleted and were kept.
During the press conference, questions were raised about the necessity of holding onto the full credit card numbers as well as the reason for their possession. The company responded, "Until July 2021, we were using credit card numbers to identify customers." Furthermore, it was stated that there was no masking or encryption of the credit card numbers during storage.
Regarding the reason why information that should have been deleted remained, the company explained, "It was not intentionally kept, but there were inappropriate aspects in the operation and management of the data." On the other hand, it was not possible to determine whether the deletion failure was due to human error or a system issue, and they stated that they would continue to investigate.
Questions were also raised about whether the possession of credit card numbers constituted a violation of the law. The amended Consumer Credit Sales Law, which came into effect in June 2018, requires credit card service merchants to either not retain card information or manage it in accordance with the international security standard "PCI DSS." The company stated, "We have recognized the non-retention of card information from the beginning," while also saying, "Whether or not we violated the law is currently under confirmation."
Was there any influence of the "MUJI Week" on the timing of the announcement?
Questions were also raised about whether the timing of the announcement of the potential leakage of credit card information (November 4) coincided with the end of the "MUJI Week" sale. The "MUJI Week" sale ran from October 23 to November 3 in physical stores, and from 10:00 AM on November 4 in the MUJI online store.
Regarding the timing of the announcement, the company stated, "There was absolutely no influence from the MUJI Week." President Shimizu explained that identifying the scope of the impact of the card information required confirmation from other companies, and that it took time to organize the facts. He then expressed the view that the announcement was made as soon as possible.
The company also explained the method of the unauthorized access. On November 9, it announced that "list-based attacks," in which third parties might have used IDs and passwords obtained illegally from outside to repeatedly attempt logins, had occurred on the MUJI online store.
During the press conference, it was explained that multiple IP addresses had attempted a large number of logins over a long period of time on the MUJI online store. The company stated that the basis for determining it as a list-based attack was that the number of attempts and the number of failed attempts had reached "a sufficient amount." It also noted that attacks leading to access to credit card information are different from list-based attacks.
The investigation detected multiple instances of unauthorized access that shared common elements, but because the attack patterns were diverse, it stated that it took time to fully understand the situation. The company said it will continue to investigate the cause and proceed with reviewing its information management system and enhancing its security measures. It also announced its intention to fully cover the fees associated with reissuing the affected cards.
