The Muji data breach may have exposed about 1.09 million full MUJI Card numbers that the retailer should already have deleted. The numbers were retained after their original use ended, and Kyodo reports they were stored without encryption or equivalent protection. This is a data-retention failure before it is a payment-provider story.

Stripe is a good option for keeping raw card numbers out of a business’s payment systems. It would not, by itself, have removed Muji’s separate archive of membership card data. The alternative to this failure is better payment collection and less unnecessary information sitting elsewhere.

What happened in the Muji data breach?

Ryohin Keikaku, Muji’s operator, detected unauthorized access on 29 October 2026. At a 12 November press conference, president Satoshi Shimizu apologized and acknowledged shortcomings in data management and a system vulnerability.

According to Kyodo’s report of the press conference, the potentially exposed card records include the full 16-digit numbers of expired, cancelled and still-valid MUJI Cards held by customers who signed up by July 2021.

The company had used those numbers to identify customers when granting rewards. It switched to other identifying information in July 2021 and adopted a policy of deleting the full numbers, but continued to retain them, Jiji reports via The Japan Times. Whether that retention was intentional remained under investigation.

That is the part worth sitting with. The business had stopped needing the numbers. The database had not stopped keeping them.

What information may have been exposed?

The figures describe different categories and should not be added together as a count of unique people. TV Asahi’s full press-conference transcript gives the following breakdown:

  • Up to 27.26 million member records may have been accessed, including email addresses, birth dates, gender and member IDs. About 750,000 of those also included names, addresses and phone numbers.
  • About 1.09 million MUJI Card records may have been accessed, including full card numbers, MUJI Card IDs and birth dates. The company said about 345,000 of the cards were still valid.
  • About 270,000 member accounts had confirmed unauthorized logins, allowing access to information available in their account pages, such as purchase history, points and address books.
  • About 440,000 cash-on-delivery recipient records may have been accessed. The company described these as recipient names and postal codes from orders between 2 January 2020 and 10 February 2025.
  • A separate, much smaller category involved 120 records containing partial checkout-card details, including the first six and last two digits and the cardholder name. These are not the 1.09 million full card numbers.

The full-number exposure concerns MUJI Card membership data, not evidence that 1.09 million checkout transactions leaked. Kyodo reports that the company plans to cover reissuance fees for potentially affected cards. The online store and some app functions remained suspended on 12 November.

Muji’s 9 November notice also described credential stuffing: attempts to sign in with credentials obtained outside Muji. Account compromise and unnecessary data retention are separate failures. Fixing one does not erase the other.

Why is keeping old card numbers such a serious failure?

Encryption matters. Access controls matter. But neither answers the earlier question: why is this information still here?

Muji’s own explanation makes that question unusually direct. The numbers had a business purpose. That purpose changed. A deletion policy existed. The old data remained available to be exposed.

A privacy policy is not a deletion process. Someone has to identify the copies, decide what must be retained, remove what should not be retained, and check that the work happened. Old exports, backups and disconnected systems need owners too.

For businesses, that is a more useful lesson than telling customers to be careful after the fact. Customers could not delete the retailer’s database. The company holding it had that responsibility.

Is this a wider problem among companies in Japan?

There is evidence of repeated failures in Japan. There is not evidence here that a company’s nationality predicts whether it can be trusted.

As of 12 November 2026, my Japan Cybersecurity Tracker lists 1,513 public incident notices, with 937, or 61.9%, classified as incidents reaching an organization through a vendor. Those are counts from a disclosure dataset, not a representative survey of every Japanese company. They do not establish that Japan is worse than another country, or that Muji’s incident came through a vendor.

They do show why “our supplier handles it” is not an adequate answer. A business still needs to know what information it hands over, which provider receives it, who can use it and what happens when the service fails. The Arara Message breach is another example of why those dependencies matter.

The reason to withhold trust is concrete: a company cannot explain what it keeps, why it keeps it, or who is responsible for removing it. A familiar brand is not an answer to any of those questions.

Why is Stripe a safer way to collect card payments?

Stripe offers a practical way to reduce the card data your own systems handle. Its hosted payment fields, Stripe Elements, collect details inside Stripe-hosted components rather than passing raw card numbers through your application code. Your application works with a payment-method identifier instead.

Stripe’s security documentation says it is certified at PCI Service Provider Level 1. It also describes encryption of card numbers at rest and internal tokenization that isolates raw numbers from the rest of its infrastructure.

That is a useful division of responsibility. Your business can collect a payment without building its own card-number archive.

On its Japan pricing page, Stripe lists a standard rate of 3.6% per successful card payment, checked 12 November 2026. Check the current terms for the payment methods and products you intend to use rather than treating that headline rate as every possible cost.

Would Stripe have prevented Muji’s breach?

No claim like that follows from the evidence.

The full numbers in this case were retained for a membership-rewards process. Changing checkout providers would not automatically find and delete that database. Nor would it protect every customer record, account, email inbox or administrator login.

A correctly designed Stripe integration can keep raw card numbers out of the systems you run. It does not make those systems breach-proof, remove your PCI responsibilities or prevent staff from collecting sensitive information through another route.

The goal is to remove a category of unnecessary exposure, then deal with what remains. It is not to replace one brand promise with another.

What are the alternatives to Stripe?

The principle is more important than the logo. Adyen’s tokenization documentation describes storing payment details in its vault and using a token for later payments, reducing the merchant’s PCI scope.

Compare providers on the payment methods your customers use, integration requirements, settlement timing, support and the complete cost. Ask a specific question before choosing: can this setup work without our business receiving or retaining full card numbers?

Then ask the less comfortable follow-up: where else are we collecting them already?

What should businesses and customers do now?

For a business, start by mapping where sensitive customer information lives. Include payment tools, membership systems, spreadsheets, exports and suppliers. Establish the business or legal reason for each category, assign an owner and a retention period, and review deletion across the relevant copies. If you are investigating an incident, preserve evidence and follow qualified incident-response advice before deleting records.

Move card collection to a properly implemented hosted or tokenized flow where possible. Review permissions and multifactor authentication for the people who can administer it. Using a specialist provider reduces some work; it does not remove the need to own the setup.

For Muji customers, read the individual notice through a known company route, monitor statements and contact your card issuer about suspicious activity or reissue. Use a unique password when the store reopens. Muji says it will not ask for passwords or card numbers by email, telephone or SMS. Do not supply them in response to an unexpected message.

Need to decide what your business should change?

If the question is which payment setup to use or where to start with an inherited system, book a Decision Session: a 45-minute conversation about one technology decision, for ¥28,000 + tax. It is a conversation, not a security audit or written assessment.

If you need a written picture of the tools, accounts, ownership and risks you already run, Diagnostics starts at ¥158,000 + tax.

Start with the work you actually need. A new payment provider can be part of the answer. Knowing what your business is keeping, and making someone responsible for it, is the part you cannot outsource away.

Reporting and provider details checked 12 November 2026. Exposure figures remain subject to the company’s investigation.