On 15 September 2026, Japanese electronics retailer Murauchi.com published a second report on an intrusion first disclosed on 24 July. It says 7,716,811 personal data records were leaked. We could not open the company's PDF notices ourselves, because its server returned an access error, so the details below come from news summaries of that notice.
What is confirmed
The company published notices on 24 July (first report) and 15 September 2026 (second report) at murauchi.com. Per the security news site ScanNetSecurity and others summarizing them:
- A fault hit an internal system in the early hours of 15 July, and traces of third party access were found on 16 July during recovery.
- The company cut external access and hired an outside security firm for forensic work.
- The second report gives the count of 7,716,811.
- Data: name, address and phone number, with email address, date of birth and gender for some people only.
- Credit card data (held in a separate system), login IDs and passwords are said to be out of scope.
- Regulator and police: reports say the Personal Information Protection Commission was notified and the police consulted.
What is reported
Two outlets, ScanNetSecurity and Innovatopia, say the second report names a vulnerability in part of a web system the company manages as the starting point, followed by access to multiple systems. A third outlet, Rocket Boys, says the entry route was not disclosed. These accounts conflict, so treat the cause as reported, not confirmed, until you read the company notice.
Reports also say no financial loss, misuse or phishing tied to the incident had been confirmed as of 15 September.
What is not known
Which product or flaw was involved, whether the figure counts unique people or records (one outlet notes the company uses the word for records), how long data was being taken, and who was behind it. No ransomware or extortion claim appears in the sources we read.
What to do now
- If you shop with the company, expect scam emails and calls that quote your name and address. Do not click links in them.
- Inventory the web systems you run yourself, including old storefront, admin and campaign sites, and patch or retire them.
- Separate card data from customer profile data, as the company says it did. That boundary limited the impact here.
- Make sure a failing internal system triggers an intrusion check, not only a restore. Here the outage led to the discovery.
How this could have been avoided
If the reports are right that a web system flaw was the entry point, then timely patching and a complete inventory of internet facing systems are the most direct controls. Restricting what a compromised web server can reach inside the network would have limited the move to other systems. Alerting on large outbound transfers would have shortened the weeks between intrusion and discovery. All of this is conditional, because the company has not published technical detail we could verify.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the 7.7 million figure a count of people?
Not necessarily. The company reports it as records, and no source we read confirms how many unique individuals are affected.
