Ryohin Keikaku (the company behind MUJI) said on Oct 30 that someone got unauthorized access to the official MUJI app. Up to about 27.26 million records may be affected, including people who already deleted their app account.

What they say leaked: email address, date of birth, gender. They say names, addresses, phone numbers and card details aren't part of it, and they haven't seen it posted or used for fraud yet.

Nobody can log in as you with that, so the practical stuff is pretty boring:

• Expect fake "MUJI" emails about points, coupons or account problems. MUJI itself warned about this. Open the app yourself instead of tapping links.
• Stop treating your birthday as a secret. If a bank or carrier uses DOB as a check, add a PIN or something stronger.
• If your MUJI password is reused anywhere, change those. Passwords aren't listed, but it's a free fix.
• Put 2FA on the email account tied to it, since email is the main thing in this leak.

The notice is Japanese only and doesn't say if MUJI apps in other countries are in scope, so if you're outside Japan watch for mail from your local MUJI.

If you get a breach notice and aren't sure what to do with it, we wrote up a plain guide here: https://osintpro.dev/resources/what-a-breach-notification-means (disclosure: I work on OSINT Pro).