91APP Reports Breach Potentially Impacting Millions as Experts Highlight AI-Driven Automated Attacks

Taiwan e-commerce service provider 91APP announced the findings of its security incident investigation during a press conference on October 30, 2026. The company stated that it initiated an internal audit on October 4 after a brand notification. Third-party findings revealed an unauthorized intrusion into a short-term database storing transaction records under 18 months old. Compromised data included names, phone numbers, and email addresses, but excluded passwords and payment details. The incident potentially affects up to 1,329 partner brands and nearly 4.8 million consumers. The report also cited that Japan's Ryohin Keikaku disclosed a breach in its official MUJI App risking about 27.26 million customer records. Taiwan MUJI clarified its app operates independently of Japan, though its local operations were impacted via 91APP's infrastructure. Commenting on the recent rise in attacks, senior cybersecurity consultant Yu Ting-sen stated that AI advances have shifted vulnerability exploitation from manual efforts to automated processes, allowing attackers to deploy hundreds or thousands of AI instances in parallel to probe and exploit systems.

Key takeaways

• 91APP confirmed a breach in its short-term database leaking names, phones, and emails, affecting up to 1,329 brands and nearly 4.8 million consumers.
• MUJI Taiwan clarified its system operates independently from MUJI Japan, but its local operations were affected via 91APP.
• A cybersecurity consultant highlighted that AI enables attackers to automate vulnerability discovery and launch large-scale parallel attacks.