Muji operator says retained card data may have been leaked