SockAnalystMediumBreach · 2026-10-30
MUJI app breach: up to 27.26M customer records
SockAnalyst · Security+ certified analyst.
What happened
Ryohin Keikaku, MUJI's operator, says its official app was breached. Access is blocked and a fix applied. No IOCs or entry vector published yet.
Who's affected
Up to 27.26M customers, including closed accounts. Data: emails, birth dates, gender. No names, addresses or cards.
✅ Fix / patch
- Add MUJI-themed sale/points lures to mail filters and user awareness training.
🔎 Quick hunt check
No published indicators yet. Expect phishing that quotes real birthdays.
MITRE ATT&CK: T1190, T1078, T1566
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
index=email (subject="*MUJI*" OR subject="*無印良品*" OR subject="*MUJI passport*")
NOT src_user="*@muji.*" NOT src_user="*@ryohin-keikaku.jp"
| stats count values(subject) as subjects by src_user, recipientEmailEvents
| where Subject has_any ("MUJI","無印良品","MUJI passport")
| where SenderFromDomain !has "muji" and SenderFromDomain !endswith "ryohin-keikaku.jp"
| summarize count(), make_set(Subject,10) by SenderFromAddress, DeliveryAction⏱ CISA deadline
Not in CISA KEV as of Nov 14, 2026.
Sources
Related playbooks
- DreamHost File Manager breach: FTP/SFTP passwords and some webmail sessions stolen · Breach · 2026-11-06
- Chainalysis discloses breach of customer contact data · Breach · 2026-10-30
- Florida Dept. of Education: ~4.9M exposed in student financial aid site breach · Breach · 2026-10-29
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free