Iris Ohyama: third-party cloud service breach may expose data of up to 7.7 million Iris Plaza customers
Matéria consolidada. Reúne 6 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 10/11/2026 12:13; os links antigos trazem para cá.
Fontes: securityaffairs.com ↗ theregister.com ↗ securityweek.com ↗ bleepingcomputer.com ↗
Japanese household goods maker Iris Ohyama, which operates the Iris Plaza online store, disclosed that personal information of up to 7.7 million people may have been exposed after unauthorized access to a third-party cloud service used by its ecommerce platform (bleepingcomputer.com, securityweek.com, theregister.com). The company found a suspicious file in the external cloud service in late October 2026 (securityaffairs.com dates this to October 28), suspended Iris Plaza and related systems, and confirmed third-party unauthorized access, which it reported on October 29, 2026 (bleepingcomputer.com, securityaffairs.com). The estimate is up to 5.8 million registered and former members plus 1.9 million non-members, described by The Register as people who bought without an account or joined promotions (bleepingcomputer.com, theregister.com, mezha.net). Security Affairs clarifies that the 7.7 million figure is the number of records stored in the affected cloud service, not a confirmed count of stolen data (securityaffairs.com). Exposed data types vary per individual and may include names, addresses, phone numbers, email addresses, dates of birth, gender and passwords, some of them encrypted (theregister.com, securityaffairs.com). The company says credit card data was not stored in the affected service and that passwords of active members are held in encrypted form, without naming the scheme; no passwords are kept for former members (bleepingcomputer.com, theregister.com, securityaffairs.com). As of November 5, 2026, no misuse or financial loss had been reported (bleepingcomputer.com, digg.com, securityaffairs.com). As of November 9, the Iris Plaza site had no reopening date and orders were shipping late (theregister.com). Actual exfiltration is not confirmed in any available source, although SecurityWeek frames the incident as data that hackers may have stolen (securityweek.com, theregister.com). Security Affairs rates the criticality as high because of the scale and the inclusion of account passwords, while noting that no exploitation or fraud is confirmed (securityaffairs.com).
Detalhes técnicos
The intrusion hit an external cloud service used by the Iris Plaza store, not the company's own storefront code, and was detected through a suspicious file found in that environment (bleepingcomputer.com, theregister.com). The attack vector, the actor and any ransom demand are unknown. A spokesperson told BleepingComputer that the company has had no direct communication from the attacker and has not identified the perpetrators (bleepingcomputer.com). The company has not named the cloud provider, has not explained how the attackers got in, and has not established whether any records left its systems (theregister.com). It has not identified a vulnerability, an initial access method or a threat actor (securityaffairs.com). The shutdown went beyond Iris Plaza: the SIMPLE STYLE online store and related systems were suspended on October 28, 2026, as were the websites of Iris Tech Service Co., Ltd., covering home appliance subscriptions and furniture and appliance delivery and installation (bleepingcomputer.com). New applications for those Iris Tech Service services were also stopped, and the company has found no evidence that they were compromised (securityaffairs.com). The Iris Plaza stores on Rakuten, Yahoo! Shopping and auPAY Market are still operating, and the company has found no evidence that they were affected (theregister.com); Iris Plaza likewise says it has identified no unauthorized access or leaks involving its stores on other external e-commerce marketplaces (securityaffairs.com). Passwords for active members were reportedly stored in encrypted form (securityaffairs.com, citing scworld.com).
Remediação
Japan's Personal Information Protection Commission and the police were notified on October 29, 2026 (bleepingcomputer.com, securityaffairs.com). Affected customers should treat Iris Plaza credentials as compromised, change any password reused elsewhere, and watch for phishing emails, fraudulent calls, fake websites or other contact impersonating Iris Plaza or referencing its orders while the investigation into the number of records continues (bleepingcomputer.com, theregister.com, securityaffairs.com). Unsolicited messages about the incident, account recovery or compensation should be treated as potential phishing, since the company says it will never ask for passwords, PIN codes or authentication codes (securityaffairs.com). The company says it will contact affected customers individually (theregister.com). Organizations should extend security controls and monitoring to third-party cloud services that hold customer data (securityaffairs.com). No vendor advisory, patch or CVE has been published for this incident, so these defensive steps are the only published guidance (theregister.com).
Relatos divergentes
The discovery date is described differently. SecurityWeek (securityweek.com) and helix.ml (cited by theregister.com) say the incident was discovered on October 28. BleepingComputer (bleepingcomputer.com) says the suspicious file was found in "late October", systems were suspended on October 28, and unauthorized access was confirmed in a first notice on October 29; The Register (theregister.com) says the incident was first disclosed on October 29. Security Affairs (securityaffairs.com, the most recent source) states that the suspicious file was found on October 28 and that the access was confirmed and reported on October 29, which matches the reading that October 28 was detection and suspension and October 29 confirmation and notification. BleepingComputer carries the most detailed company statements.
The scope of the 7.7 million figure is also framed differently. Several outlets describe it as up to 7.7 million people who may have been exposed (bleepingcomputer.com, securityweek.com, theregister.com), while Security Affairs (securityaffairs.com) says it is the number of records stored in the affected cloud service and not a confirmed count of stolen data. The latter is the more precise and more recent wording.
Linha do tempo
-
Iris Ohyama's Iris Plaza discloses unauthorized access to external cloud service holding 7.7 million customer records
ler a análise desta fonte ocultar
Iris Ohyama disclosed that unauthorized third parties may have accessed personal information of about 7.7 million people through an external cloud service used by its online shopping subsidiary Iris Plaza. The 7.7 million figure is the number of records stored in the affected cloud service, not a confirmed count of stolen data. The exposed population is 5.8 million current and former members and 1.9 million non-members, and the exposed fields may include names, addresses, phone numbers, email addresses, gender, dates of birth and passwords, some of which are encrypted. Iris Plaza found a suspicious file on October 28, 2026, shut down its online shopping platform and related systems, and confirmed unauthorized access, which it reported to Japanese police and the Personal Information Protection Commission on October 29. As of November 5 the company had received no reports of fraudulent use or financial loss, and it says credit card data was not stored in the affected cloud service. The criticity is high because the exposure is large and includes account passwords, but the access route is not identified and no exploitation or fraud has been confirmed.
Technical Details
- The company describes the incident as unauthorized access to data stored on an external cloud service, and it has not identified a vulnerability, initial access method or threat actor.
- Iris Plaza says it has not identified unauthorized access or leaks involving its stores on other external e-commerce marketplaces.
- The company says Iris Tech Service's websites and new applications for home appliance subscriptions and furniture and appliance delivery and installation services were stopped, and it has found no evidence that these services were compromised (securityaffairs.com).
- Passwords for active members were reportedly stored in encrypted form (scworld.com).
Remediation
- Customers who reused their Iris Plaza passwords on other services should change them.
- Customers should treat unsolicited messages about the incident, account recovery or compensation as potential phishing, since the company says it will never ask for passwords, PIN codes or authentication codes.
- Organizations should extend security controls and monitoring to third-party cloud services that hold customer data.
-
Iris Ohyama takes Iris Plaza online store offline after third-party cloud breach may expose 7.7M customer records
ler a análise desta fonte ocultar
Iris Ohyama, the Japanese homeware and appliance retailer, has taken its Iris Plaza online store offline after unauthorized access to a third-party cloud service used by its ecommerce platform. The company says the affected environment may have held personal data of about 7.7 million people: roughly 5.8 million registered customers, including former members, and 1.9 million people who bought without an account or joined promotions (theregister.com; mezha.net). Exposed fields may include names, addresses, phone numbers, email addresses, dates of birth, gender and passwords, some of them encrypted with a scheme the company has not specified. The retailer says payment card data was not stored in the affected service. Exfiltration is not confirmed, the cloud provider has not been named, and the intrusion path is unknown, while the website has no reopening date and orders are shipping late.
Technical Details
- A suspicious file was found on the third-party cloud service used by Iris Plaza, and the incident was first disclosed on October 29 (theregister.com). Another report dates the discovery to October 28 (helix.ml).
- The company has not identified the cloud provider or explained how the attackers got in, and it has not established whether any records left its systems (theregister.com).
- As of November 5 the company had received no reports of misuse or financial loss tied to the incident (digg.com, citing bleepingcomputer.com).
- The Iris Plaza stores on Rakuten, Yahoo! Shopping and auPAY Market are still operating, and the company has found no evidence that they were affected (theregister.com).
Remediation
- Customers who reused their Iris Plaza password on other services should change those passwords (theregister.com).
- Users should watch for phishing emails, fraudulent calls and fake websites impersonating the retailer, and the company says it will contact affected customers individually (theregister.com).
- No vendor advisory, patch or CVE has been published for this incident, so the defensive steps above are the only published guidance.
-
Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
ler a análise desta fonte ocultar
Hackers may have stolen the personal information of 7.7 million people from Japanese online shopping platform Iris Plaza.
The incident, says household products and appliance manufacturer Iris Ohyama, which operates the platform, was discovered on October 28.
-
Iris Ohyama breach of third-party cloud service exposes data of up to 7.7 million Iris Plaza customers
ler a análise desta fonte ocultar
Japanese household goods manufacturer Iris Ohyama, operator of the Iris Plaza online store, disclosed that personal information of about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service it used. The company found a suspicious file in the external cloud service in late October 2026, immediately suspended Iris Plaza and related systems, and confirmed third-party unauthorized access in a first notice on October 29, 2026. The impact is estimated at up to 5.8 million registered and former members and 1.9 million non-members, with exposed data types varying per individual. The company states that credit card data was not stored in the affected cloud service and that passwords of active members are held in encrypted form, without naming the scheme; no passwords are kept for former members. As of November 5, 2026, no reports of misuse or financial loss had been received.
Technical Details
The intrusion affected an external cloud service used by the Iris Plaza online store rather than the company's own storefront code; detection came from a suspicious file found in that environment. The attack vector, the actor and any ransom demand remain unknown — a spokesperson told BleepingComputer that the company received no direct communication from the attacker and has not identified the perpetrators. The scope of the shutdown extends beyond the shop: the SIMPLE STYLE online store and related systems were suspended on October 28, 2026, as were the websites of Iris Tech Service Co., Ltd., covering home appliance subscriptions and furniture and appliance delivery and installation.
Remediation
Japan's Personal Information Protection Commission and the police were notified on October 29, 2026. Affected customers should treat Iris Plaza credentials as compromised, change any password reused elsewhere, and remain alert to phishing or fraudulent contact referencing Iris Plaza orders while the investigation into the number of records continues.