Muji retailer under scrutiny over credit card data retention
Ryohin Keikaku Co., the operator of the Muji retail chain, said Thursday that the company's failure to delete unnecessary customer credit card information was a factor behind a data breach involving up to 1.09 million credit card records through unauthorized access, JIJI PRESS reports.
"We must feel a deep sense of responsibility," Ryohin Keikaku President Satoshi Shimizu said at a press conference. "There were shortcomings in our data management."
Ryohin Keikaku had retained full credit card numbers of its "Muji Card" credit cards, which it used to identify customers when granting rewards until July 2021, when it switched to using other information for identification. The company continued to retain the data despite adopting a policy of deleting full credit card numbers.
The company said it is continuing to investigate the matter, as it remains unclear whether the data retention was intentional.
Ryohin Keikaku detected unauthorized access on Oct. 29. It believes that up to around 27.26 million customer records, including the email addresses of registered users, may have been compromised.
Earlier, it was reported that around 77 million email addresses leaked from Japan's Arara Message email distribution service due to unauthorized access last month.
