Iris Ohyama breach of third-party cloud service exposes data of up to 7.7 million Iris Plaza customers
Japanese household goods manufacturer Iris Ohyama, operator of the Iris Plaza online store, disclosed that personal information of about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service it used. The company found a suspicious file in the external cloud service in late October 2026, immediately suspended Iris Plaza and related systems, and confirmed third-party unauthorized access in a first notice on October 29, 2026. The impact is estimated at up to 5.8 million registered and former members and 1.9 million non-members, with exposed data types varying per individual. The company states that credit card data was not stored in the affected cloud service and that passwords of active members are held in encrypted form, without naming the scheme; no passwords are kept for former members. As of November 5, 2026, no reports of misuse or financial loss had been received.
Detalhes técnicos
The intrusion affected an external cloud service used by the Iris Plaza online store rather than the company's own storefront code; detection came from a suspicious file found in that environment. The attack vector, the actor and any ransom demand remain unknown — a spokesperson told BleepingComputer that the company received no direct communication from the attacker and has not identified the perpetrators. The scope of the shutdown extends beyond the shop: the SIMPLE STYLE online store and related systems were suspended on October 28, 2026, as were the websites of Iris Tech Service Co., Ltd., covering home appliance subscriptions and furniture and appliance delivery and installation.
Remediação
Japan's Personal Information Protection Commission and the police were notified on October 29, 2026. Affected customers should treat Iris Plaza credentials as compromised, change any password reused elsewhere, and remain alert to phishing or fraudulent contact referencing Iris Plaza orders while the investigation into the number of records continues.
Linha do tempo
-
Iris Ohyama breach of third-party cloud service exposes data of up to 7.7 million Iris Plaza customers
ler a análise desta fonte ocultar
Japanese household goods manufacturer Iris Ohyama, operator of the Iris Plaza online store, disclosed that personal information of about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service it used. The company found a suspicious file in the external cloud service in late October 2026, immediately suspended Iris Plaza and related systems, and confirmed third-party unauthorized access in a first notice on October 29, 2026. The impact is estimated at up to 5.8 million registered and former members and 1.9 million non-members, with exposed data types varying per individual. The company states that credit card data was not stored in the affected cloud service and that passwords of active members are held in encrypted form, without naming the scheme; no passwords are kept for former members. As of November 5, 2026, no reports of misuse or financial loss had been received.
Technical Details
The intrusion affected an external cloud service used by the Iris Plaza online store rather than the company's own storefront code; detection came from a suspicious file found in that environment. The attack vector, the actor and any ransom demand remain unknown — a spokesperson told BleepingComputer that the company received no direct communication from the attacker and has not identified the perpetrators. The scope of the shutdown extends beyond the shop: the SIMPLE STYLE online store and related systems were suspended on October 28, 2026, as were the websites of Iris Tech Service Co., Ltd., covering home appliance subscriptions and furniture and appliance delivery and installation.
Remediation
Japan's Personal Information Protection Commission and the police were notified on October 29, 2026. Affected customers should treat Iris Plaza credentials as compromised, change any password reused elsewhere, and remain alert to phishing or fraudulent contact referencing Iris Plaza orders while the investigation into the number of records continues.