Iris Ohyama's Iris Plaza discloses unauthorized access to external cloud service holding 7.7 million customer records
Iris Ohyama disclosed that unauthorized third parties may have accessed personal information of about 7.7 million people through an external cloud service used by its online shopping subsidiary Iris Plaza. The 7.7 million figure is the number of records stored in the affected cloud service, not a confirmed count of stolen data. The exposed population is 5.8 million current and former members and 1.9 million non-members, and the exposed fields may include names, addresses, phone numbers, email addresses, gender, dates of birth and passwords, some of which are encrypted. Iris Plaza found a suspicious file on October 28, 2026, shut down its online shopping platform and related systems, and confirmed unauthorized access, which it reported to Japanese police and the Personal Information Protection Commission on October 29. As of November 5 the company had received no reports of fraudulent use or financial loss, and it says credit card data was not stored in the affected cloud service. The criticity is high because the exposure is large and includes account passwords, but the access route is not identified and no exploitation or fraud has been confirmed.
Detalhes técnicos
- The company describes the incident as unauthorized access to data stored on an external cloud service, and it has not identified a vulnerability, initial access method or threat actor.
- Iris Plaza says it has not identified unauthorized access or leaks involving its stores on other external e-commerce marketplaces.
- The company says Iris Tech Service's websites and new applications for home appliance subscriptions and furniture and appliance delivery and installation services were stopped, and it has found no evidence that these services were compromised (securityaffairs.com).
- Passwords for active members were reportedly stored in encrypted form (scworld.com).
Remediação
- Customers who reused their Iris Plaza passwords on other services should change them.
- Customers should treat unsolicited messages about the incident, account recovery or compensation as potential phishing, since the company says it will never ask for passwords, PIN codes or authentication codes.
- Organizations should extend security controls and monitoring to third-party cloud services that hold customer data.
Linha do tempo
-
Iris Ohyama's Iris Plaza discloses unauthorized access to external cloud service holding 7.7 million customer records
ler a análise desta fonte ocultar
Iris Ohyama disclosed that unauthorized third parties may have accessed personal information of about 7.7 million people through an external cloud service used by its online shopping subsidiary Iris Plaza. The 7.7 million figure is the number of records stored in the affected cloud service, not a confirmed count of stolen data. The exposed population is 5.8 million current and former members and 1.9 million non-members, and the exposed fields may include names, addresses, phone numbers, email addresses, gender, dates of birth and passwords, some of which are encrypted. Iris Plaza found a suspicious file on October 28, 2026, shut down its online shopping platform and related systems, and confirmed unauthorized access, which it reported to Japanese police and the Personal Information Protection Commission on October 29. As of November 5 the company had received no reports of fraudulent use or financial loss, and it says credit card data was not stored in the affected cloud service. The criticity is high because the exposure is large and includes account passwords, but the access route is not identified and no exploitation or fraud has been confirmed.
Technical Details
- The company describes the incident as unauthorized access to data stored on an external cloud service, and it has not identified a vulnerability, initial access method or threat actor.
- Iris Plaza says it has not identified unauthorized access or leaks involving its stores on other external e-commerce marketplaces.
- The company says Iris Tech Service's websites and new applications for home appliance subscriptions and furniture and appliance delivery and installation services were stopped, and it has found no evidence that these services were compromised (securityaffairs.com).
- Passwords for active members were reportedly stored in encrypted form (scworld.com).
Remediation
- Customers who reused their Iris Plaza passwords on other services should change them.
- Customers should treat unsolicited messages about the incident, account recovery or compensation as potential phishing, since the company says it will never ask for passwords, PIN codes or authentication codes.
- Organizations should extend security controls and monitoring to third-party cloud services that hold customer data.