Iris Ohyama, the Japanese household goods and appliance maker, says the personal details of roughly 7.7 million people may have been exposed after attackers got into a third-party cloud service used by its Iris Plaza online store. The shop has been offline since late October, and the company still can't say exactly how much data left its systems.
What happened
On October 28, 2026, Iris Plaza, the group company that runs Iris Ohyama's official web store, found a suspicious file sitting in an external cloud service it relies on. It shut down the Iris Plaza site and connected systems the same day, cut off the route the intruders had used, and started an investigation. A first public notice went out on October 29, and the company reported the incident to Japanese police and the Personal Information Protection Commission that day.
In a second notice published on November 5, Iris Plaza said the investigation had confirmed a third party had accessed the cloud service without permission, and that the customer data stored there may have been viewed or taken. The company is still working out the real number of leaked records and affected people, and it has not named the cloud provider, explained how the attackers got in, or said who was behind it. A spokesperson told BleepingComputer the company had received no direct contact from the attackers.
Who's affected
The affected cloud service held data on about 7.7 million people, split into two groups:
- About 5.8 million current and former members: names, home addresses, phone numbers, email addresses, gender, dates of birth and account passwords. Passwords were not kept for people who had already closed their accounts.
- About 1.9 million non-members: people who bought something without registering or entered a promotion. For them, the data is names, addresses, phone numbers and email addresses.
Not every record contains every field. Iris Plaza says passwords and some other items were stored encrypted, but it hasn't said which method it used. Credit card information was not stored in the affected service, and the company says Iris Plaza storefronts on outside shopping malls show no sign of being hit. As of November 5, it had no reports of the data being misused or of any financial losses.
Knock-on effects
As a precaution, Iris Plaza also took down its SIMPLE STYLE home fashion store on October 28. Iris Tech Service, another group company, suspended the websites and new sign-ups for its home appliance subscription and furniture and appliance delivery and installation services. Neither shows evidence of a breach, but both remain offline along with the main store, and no reopening date has been given. Iris Plaza says it will contact affected customers individually by email and other means.
Why it matters
Names, home addresses, phone numbers and birth dates for millions of shoppers make a ready-made kit for fraud. Even without payment cards, criminals can use this kind of data for convincing phishing emails, texts and phone calls that reference real purchases, and for identity scams. Unknown password encryption is a further worry: if it turns out to be weak, reused passwords could be tried on other sites. The case is also another reminder that data parked in third-party cloud services is only as safe as the way that service is set up and watched.
What you should do
- If you've ever shopped on Iris Plaza, change your password anywhere else you used the same one, and turn on two-factor authentication where you can.
- Expect scams. Iris Plaza says it will never ask for passwords, PINs or verification codes, or ask you to enter them through a link in an email or SMS. Don't open attachments or click links in unexpected messages that claim to come from the company.
- Watch for fake websites and social media accounts pretending to be Iris Ohyama or Iris Plaza, and don't enter card details or login information on them.
- Be cautious with unexpected calls that mention your orders, address or date of birth.
- For businesses, review what customer data sits in outside cloud services, who can reach it, and whether you'd notice an unfamiliar file appearing there.
0 Comments