Iris Ohyama: third-party cloud service breach may expose data of up to 7.7 million Iris Plaza customers
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 09/11/2026 12:12; os links antigos trazem para cá.
Japanese household goods maker Iris Ohyama, which operates the Iris Plaza online store, disclosed that personal information of up to 7.7 million people may have been exposed after unauthorized access to a third-party cloud service it uses (bleepingcomputer.com, securityweek.com). The company found a suspicious file in the external cloud service in late October 2026, suspended Iris Plaza and related systems, and confirmed third-party unauthorized access in a first notice on October 29, 2026 (bleepingcomputer.com). The estimate is up to 5.8 million registered and former members plus 1.9 million non-members, and the exposed data types vary per individual (bleepingcomputer.com). The company says credit card data was not stored in the affected service and that passwords of active members are held in encrypted form, without naming the scheme; no passwords are kept for former members (bleepingcomputer.com). As of November 5, 2026, no misuse or financial loss had been reported (bleepingcomputer.com). SecurityWeek frames the incident as data that hackers may have stolen, but actual exfiltration is not confirmed in the available sources.
Detalhes técnicos
The intrusion hit an external cloud service used by the Iris Plaza store, not the company's own storefront code, and was detected through a suspicious file found in that environment (bleepingcomputer.com). The attack vector, the actor and any ransom demand are unknown. A spokesperson told BleepingComputer that the company has had no direct communication from the attacker and has not identified the perpetrators (bleepingcomputer.com). The shutdown went beyond Iris Plaza: the SIMPLE STYLE online store and related systems were suspended on October 28, 2026, as were the websites of Iris Tech Service Co., Ltd., covering home appliance subscriptions and furniture and appliance delivery and installation (bleepingcomputer.com).
Remediação
Japan's Personal Information Protection Commission and the police were notified on October 29, 2026 (bleepingcomputer.com). Affected customers should treat Iris Plaza credentials as compromised, change any password reused elsewhere, and watch for phishing or fraudulent contact referencing Iris Plaza orders while the investigation into the number of records continues (bleepingcomputer.com).
Relatos divergentes
The discovery date is described differently. SecurityWeek (securityweek.com) says the incident was discovered on October 28. BleepingComputer (bleepingcomputer.com) says the suspicious file was found in "late October", systems were suspended on October 28, and unauthorized access was confirmed in a first notice on October 29. The two are compatible if October 28 was the detection and suspension date and October 29 the confirmation and notification date, but neither source states this explicitly. SecurityWeek is the more recent, but its report is shorter and BleepingComputer carries the more detailed company statements.
Linha do tempo
-
Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
ler a análise desta fonte ocultar
Hackers may have stolen the personal information of 7.7 million people from Japanese online shopping platform Iris Plaza.
The incident, says household products and appliance manufacturer Iris Ohyama, which operates the platform, was discovered on October 28.
-
Iris Ohyama breach of third-party cloud service exposes data of up to 7.7 million Iris Plaza customers
ler a análise desta fonte ocultar
Japanese household goods manufacturer Iris Ohyama, operator of the Iris Plaza online store, disclosed that personal information of about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service it used. The company found a suspicious file in the external cloud service in late October 2026, immediately suspended Iris Plaza and related systems, and confirmed third-party unauthorized access in a first notice on October 29, 2026. The impact is estimated at up to 5.8 million registered and former members and 1.9 million non-members, with exposed data types varying per individual. The company states that credit card data was not stored in the affected cloud service and that passwords of active members are held in encrypted form, without naming the scheme; no passwords are kept for former members. As of November 5, 2026, no reports of misuse or financial loss had been received.
Technical Details
The intrusion affected an external cloud service used by the Iris Plaza online store rather than the company's own storefront code; detection came from a suspicious file found in that environment. The attack vector, the actor and any ransom demand remain unknown — a spokesperson told BleepingComputer that the company received no direct communication from the attacker and has not identified the perpetrators. The scope of the shutdown extends beyond the shop: the SIMPLE STYLE online store and related systems were suspended on October 28, 2026, as were the websites of Iris Tech Service Co., Ltd., covering home appliance subscriptions and furniture and appliance delivery and installation.
Remediation
Japan's Personal Information Protection Commission and the police were notified on October 29, 2026. Affected customers should treat Iris Plaza credentials as compromised, change any password reused elsewhere, and remain alert to phishing or fraudulent contact referencing Iris Plaza orders while the investigation into the number of records continues.