MUJI Taiwan said in a website notice that an order database run by cloud provider 91APP was breached, affecting names, phone numbers and delivery addresses of online-shop customers. Credit card details and member passwords were not involved, it said.
According to the United Daily News on the night of October 30, MUJI Taiwan was told by third-party cloud provider 91APP on October 29 that its order database had been intruded. The company confirmed part of its website order data was stored there, began responding at once, and reported the incident to the competent authority and others on October 30.
광고 문의 · 300×250The affected scope covers orders placed on the MUJI website from April 4, 2025 to October 14, 2026. The exposed fields are customer name, phone number, delivery address, email address if provided, and order records. The number of customers affected was not stated in the report.
What was not affected and next steps
MUJI said credit card data and member login passwords were not affected, nor was purchase data from its physical stores in Taiwan. 91APP said it blocked the intrusion on October 14, replaced internal system and database account passwords, and is compiling the list of affected customers.
91APP is authorized to notify affected customers by SMS and email starting November 2. Customers who encounter fraud or financial loss can contact the 91APP service team at (02) 7723-1622 or MUJI customer service at 0800-50-51-51.
MUJI stressed that it will never ask customers by phone, SMS, email or LINE to operate an ATM or make online banking transfers, nor request OTP codes, card details or member passwords. Anyone receiving a suspicious contact should avoid clicking links and verify through the 165 anti-fraud hotline. No further detail on the intrusion route or the scale of exposure has been given.
