VULNpocalypse
MediumBreach / campaignMonitoring

Iris Ohyama says Iris Plaza cloud breach may expose 7.7 million people

Iris Ohyama says unauthorized cloud access may have exposed data of 7.7 million Iris Plaza users, so change any reused Iris Plaza password now.

Published
Updated
Exploitation
No, the company reported no misuse or financial loss as of November 5, according to BleepingComputer

What happened

BleepingComputer reports that Japanese manufacturer Iris Ohyama, which operates the Iris Plaza shopping platform, disclosed that personal information of about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service it used. This advisory relies on that single report and the company statements it quotes.

According to the company, quoted by BleepingComputer:

  • It found a suspicious file in an external cloud service used by the Iris Plaza online store. It then suspended Iris Plaza and related systems and confirmed unauthorized access by a third party.
  • It first disclosed the incident on October 29. On October 28 it suspended the online store (SIMPLE STYLE), related systems, and websites for Iris Tech Service Co., Ltd. services, including home appliance subscriptions and furniture and appliance delivery and installation.
  • Its investigation found that customer data stored in the affected cloud service may have been accessed. It is still working out the number of records and people affected. It says the possible impact extends to up to 5.8 million registered members and former members, plus 1.9 million non-members.
  • Japan’s Personal Information Protection Commission and police were notified on October 29, 2026.

Several details are not confirmed. The company has not named the cloud service or explained how access was gained. A spokesperson told BleepingComputer the company had received no direct communication from the attacker and had not identified the perpetrators. Whether a ransom was demanded is not confirmed.

Am I affected?

According to the company via BleepingComputer, you may be affected if you are a current or former registered Iris Plaza member, or a non-member customer.

The company lists these data types as possibly exposed. The set varies by person:

  • Full names
  • Physical addresses
  • Phone numbers
  • Email addresses
  • Gender
  • Dates of birth
  • Account passwords

The company says no passwords are stored for former members. It says passwords for active members are stored encrypted but has not said which scheme it uses. It also says credit card information was not stored in the affected cloud service.

What to do now

  1. If you used your Iris Plaza password on any other service, change it there. The company says passwords were encrypted, but the method is not confirmed.
  2. When Iris Plaza is back online, follow any password reset or account instructions the company issues.
  3. Be cautious with unexpected emails, calls or texts that mention Iris Plaza or Iris Ohyama. Names, addresses, phone numbers and email addresses are among the data the company says may have been exposed.
  4. Watch for further notices from Iris Ohyama on the confirmed number of people and records affected.

Update, 9 November 2026

  • SecurityWeek says Iris Ohyama reports that the 1.9 million non-members had names, addresses, phone numbers and email addresses compromised, while the 5.8 million members and former members also had dates of birth, gender and encrypted passwords compromised. (securityweek.com)
  • SecurityWeek says Iris Ohyama states it has blocked the attackers’ access to the cloud service, retained external experts to aid the investigation, and that its incident FAQ says there have been no reports of unauthorized use or financial damage so far. (securityweek.com)
  • SecurityWeek says Iris Ohyama also suspended the Simple Style home fashion store, the Iris Group home appliance subscription service, delivery and installation services, and new applications to those sites, though it has no evidence these were compromised. (securityweek.com)
  • The Register says Iris Plaza’s stores on Rakuten, Yahoo! Shopping and auPAY Market are still operating, and the company says it has found no evidence they were affected. (theregister.com)
  • The Register says Iris Ohyama will contact potentially affected customers individually, has given no reopening date for Iris Plaza, and says in its FAQ that it is still investigating whether a data leak occurred. Orders are shipping more slowly, and customers cancelling may have to refuse delivery. (theregister.com)
  • The Register says the 1.9 million non-members are people who purchased products without creating an account or took part in promotional campaigns. (theregister.com)

Sources