Iris Ohyama Reports Data Breach Affecting 7.7 Million Customers
Japanese manufacturer Iris Ohyama, which operates the Iris Plaza shopping platform, has disclosed that personal information belonging to about 7.7 million individuals may have been exposed following unauthorized access to a third-party cloud service.
The company became aware of the incident late last month and publicly announced it on October 29, along with a temporary suspension of the site.
In an update provided earlier this week, Iris Ohyama reported discovering a suspicious file in the external cloud service utilized by the Iris Plaza online store.
“We immediately suspended Iris Plaza and related systems and began an investigation. We confirmed unauthorized access by a third party and disclosed it in our first notice on October 29,” the company stated.
The investigation has confirmed that customer data stored in the compromised cloud service may have been accessed by unauthorized actors.
While the company is still assessing the total number of records exposed and the individuals affected, it estimates that the breach impacts up to 5.8 million registered members and former members, as well as 1.9 million non-members.
Iris Plaza serves as the online storefront for the Iris Ohyama Group, a prominent Japanese manufacturer of various household products, including storage units, LED lighting, home appliances, and garden accessories.
According to the company’s notification, the following types of information may have been exposed:
- Full names
- Physical addresses
- Phone numbers
- Email addresses
- Gender
- Dates of birth
- Account passwords
The types of exposed data vary for each individual; for instance, former members do not have stored passwords.
Iris Plaza indicated that passwords for active registered members are stored in encrypted form, although the specific encryption method was not disclosed.
The company also confirmed that credit card information was not stored in the affected cloud service.
As of November 5, Iris Plaza had not received any reports of misuse of the exposed information or financial losses related to the incident.
In response to the breach, the company suspended its online store (SIMPLE STYLE) and related systems on October 28. This suspension also applies to the websites for Iris Tech Service Co., Ltd., which offers home appliance subscriptions and delivery and installation services.
Japan’s Personal Information Protection Commission and police were notified of the incident on October 29, 2026.
BleepingComputer reached out to Iris Plaza for further details regarding the attack and whether a ransom payment had been demanded. A spokesperson stated that they had not received direct communications from the attacker and had not identified the perpetrators.
Source: BleepingComputer