Iris Ohyama: third-party cloud service breach may expose data of up to 7.7 million Iris Plaza customers
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 10/11/2026 00:03; os links antigos trazem para cá.
Fontes: theregister.com ↗ securityweek.com ↗ bleepingcomputer.com ↗
Japanese household goods maker Iris Ohyama, which operates the Iris Plaza online store, disclosed that personal information of up to 7.7 million people may have been exposed after unauthorized access to a third-party cloud service used by its ecommerce platform (bleepingcomputer.com, securityweek.com, theregister.com). The company found a suspicious file in the external cloud service in late October 2026, suspended Iris Plaza and related systems, and confirmed third-party unauthorized access in a first notice on October 29, 2026 (bleepingcomputer.com). The estimate is up to 5.8 million registered and former members plus 1.9 million non-members, described by The Register as people who bought without an account or joined promotions (bleepingcomputer.com, theregister.com, mezha.net). Exposed data types vary per individual and may include names, addresses, phone numbers, email addresses, dates of birth, gender and passwords (theregister.com). The company says credit card data was not stored in the affected service and that passwords of active members are held in encrypted form, without naming the scheme; no passwords are kept for former members (bleepingcomputer.com, theregister.com). As of November 5, 2026, no misuse or financial loss had been reported (bleepingcomputer.com, digg.com). As of November 9, the Iris Plaza site had no reopening date and orders were shipping late (theregister.com). Actual exfiltration is not confirmed in any available source, although SecurityWeek frames the incident as data that hackers may have stolen (securityweek.com, theregister.com).
Detalhes técnicos
The intrusion hit an external cloud service used by the Iris Plaza store, not the company's own storefront code, and was detected through a suspicious file found in that environment (bleepingcomputer.com, theregister.com). The attack vector, the actor and any ransom demand are unknown. A spokesperson told BleepingComputer that the company has had no direct communication from the attacker and has not identified the perpetrators (bleepingcomputer.com). The company has not named the cloud provider, has not explained how the attackers got in, and has not established whether any records left its systems (theregister.com). The shutdown went beyond Iris Plaza: the SIMPLE STYLE online store and related systems were suspended on October 28, 2026, as were the websites of Iris Tech Service Co., Ltd., covering home appliance subscriptions and furniture and appliance delivery and installation (bleepingcomputer.com). The Iris Plaza stores on Rakuten, Yahoo! Shopping and auPAY Market are still operating, and the company has found no evidence that they were affected (theregister.com).
Remediação
Japan's Personal Information Protection Commission and the police were notified on October 29, 2026 (bleepingcomputer.com). Affected customers should treat Iris Plaza credentials as compromised, change any password reused elsewhere, and watch for phishing emails, fraudulent calls, fake websites or other contact impersonating Iris Plaza or referencing its orders while the investigation into the number of records continues (bleepingcomputer.com, theregister.com). The company says it will contact affected customers individually (theregister.com). No vendor advisory, patch or CVE has been published for this incident, so these defensive steps are the only published guidance (theregister.com).
Relatos divergentes
The discovery date is described differently. SecurityWeek (securityweek.com) and helix.ml (cited by theregister.com) say the incident was discovered on October 28. BleepingComputer (bleepingcomputer.com) says the suspicious file was found in "late October", systems were suspended on October 28, and unauthorized access was confirmed in a first notice on October 29; The Register (theregister.com) says the incident was first disclosed on October 29. The accounts are compatible if October 28 was the detection and suspension date and October 29 the confirmation and notification date, but no source states this explicitly. BleepingComputer carries the most detailed company statements; The Register is the most recent report.
Linha do tempo
-
Iris Ohyama takes Iris Plaza online store offline after third-party cloud breach may expose 7.7M customer records
ler a análise desta fonte ocultar
Iris Ohyama, the Japanese homeware and appliance retailer, has taken its Iris Plaza online store offline after unauthorized access to a third-party cloud service used by its ecommerce platform. The company says the affected environment may have held personal data of about 7.7 million people: roughly 5.8 million registered customers, including former members, and 1.9 million people who bought without an account or joined promotions (theregister.com; mezha.net). Exposed fields may include names, addresses, phone numbers, email addresses, dates of birth, gender and passwords, some of them encrypted with a scheme the company has not specified. The retailer says payment card data was not stored in the affected service. Exfiltration is not confirmed, the cloud provider has not been named, and the intrusion path is unknown, while the website has no reopening date and orders are shipping late.
Technical Details
- A suspicious file was found on the third-party cloud service used by Iris Plaza, and the incident was first disclosed on October 29 (theregister.com). Another report dates the discovery to October 28 (helix.ml).
- The company has not identified the cloud provider or explained how the attackers got in, and it has not established whether any records left its systems (theregister.com).
- As of November 5 the company had received no reports of misuse or financial loss tied to the incident (digg.com, citing bleepingcomputer.com).
- The Iris Plaza stores on Rakuten, Yahoo! Shopping and auPAY Market are still operating, and the company has found no evidence that they were affected (theregister.com).
Remediation
- Customers who reused their Iris Plaza password on other services should change those passwords (theregister.com).
- Users should watch for phishing emails, fraudulent calls and fake websites impersonating the retailer, and the company says it will contact affected customers individually (theregister.com).
- No vendor advisory, patch or CVE has been published for this incident, so the defensive steps above are the only published guidance.
-
Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
ler a análise desta fonte ocultar
Hackers may have stolen the personal information of 7.7 million people from Japanese online shopping platform Iris Plaza.
The incident, says household products and appliance manufacturer Iris Ohyama, which operates the platform, was discovered on October 28.
-
Iris Ohyama breach of third-party cloud service exposes data of up to 7.7 million Iris Plaza customers
ler a análise desta fonte ocultar
Japanese household goods manufacturer Iris Ohyama, operator of the Iris Plaza online store, disclosed that personal information of about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service it used. The company found a suspicious file in the external cloud service in late October 2026, immediately suspended Iris Plaza and related systems, and confirmed third-party unauthorized access in a first notice on October 29, 2026. The impact is estimated at up to 5.8 million registered and former members and 1.9 million non-members, with exposed data types varying per individual. The company states that credit card data was not stored in the affected cloud service and that passwords of active members are held in encrypted form, without naming the scheme; no passwords are kept for former members. As of November 5, 2026, no reports of misuse or financial loss had been received.
Technical Details
The intrusion affected an external cloud service used by the Iris Plaza online store rather than the company's own storefront code; detection came from a suspicious file found in that environment. The attack vector, the actor and any ransom demand remain unknown — a spokesperson told BleepingComputer that the company received no direct communication from the attacker and has not identified the perpetrators. The scope of the shutdown extends beyond the shop: the SIMPLE STYLE online store and related systems were suspended on October 28, 2026, as were the websites of Iris Tech Service Co., Ltd., covering home appliance subscriptions and furniture and appliance delivery and installation.
Remediation
Japan's Personal Information Protection Commission and the police were notified on October 29, 2026. Affected customers should treat Iris Plaza credentials as compromised, change any password reused elsewhere, and remain alert to phishing or fraudulent contact referencing Iris Plaza orders while the investigation into the number of records continues.