Iris Ohyama Cloud Breach May Expose 7.7M Customers
Iris Ohyama says a third-party cloud service tied to its Iris Plaza store was accessed by an unauthorized party. Up to 7.7 million people may be affected.
Marisol "Fuse" DelgadoJapanese household goods maker Iris Ohyama says personal data on up to 7.7 million people may have been exposed after an unauthorized party got into an external cloud service used by its Iris Plaza online store. BleepingComputer reported the update on November 8, 2026.
What we know
- The company found a suspicious file in the external cloud service late last month, suspended Iris Plaza and related systems on October 28, and confirmed third-party access in a first notice on October 29.
- Up to 5.8 million registered and former members and 1.9 million non-members may be affected. The company is still working out how many records were actually exposed.
- Data that may have been exposed: full names, physical addresses, phone numbers, email addresses, gender, dates of birth and account passwords. What was exposed varies by person. Former members have no stored passwords.
- Iris Plaza says passwords for active members are stored in encrypted form. It did not say which scheme it uses.
- Credit card data was not stored in the affected service.
- As of November 5, the company had received no reports of misuse or financial loss.
- Japan’s Personal Information Protection Commission and police were notified on October 29.
- A spokesperson told BleepingComputer the company has received no direct communication from the attacker and has not identified who is responsible.
The company has not said how the attacker got into the cloud service, and whether a ransom was demanded is unknown.
What to do
If you are a customer: change your Iris Plaza password, and change it anywhere else you reused it. Treat unexpected email or SMS that mentions your name, address or an order as suspect, since that data combination is what phishing crews want. Turn on multi-factor authentication where the service offers it.
If you run a store or any service that keeps customer data with a vendor: this is the part to take seriously. The breach was not in Iris Ohyama’s own systems. It was in a service they handed data to. Priorities, in order:
- Inventory which external cloud services hold customer records, and what fields they hold.
- Check that each one enforces MFA and limits who can reach the data.
- Keep only the data you need there. Dates of birth and gender sitting in a vendor store is exposure you chose.
- Use slow, salted password hashing so a leaked store is expensive to crack, and say which scheme you use in your notices.
Analysis: “encrypted” is a weak word for stored passwords. Passwords should be hashed, not encrypted, because encrypted values can be reversed with the key. Until Iris Plaza says what it uses, active members should assume the passwords are at risk.
Related coverage
- Tailscale SSH Flaws Exposed Before Patches Ready
- Wasmtime Patches Two Critical Sandbox Escapes
- Postiz Patches Critical Token Confusion Bug, CVSS 9.9
More in the cloud hub.
Found this useful? Share it.
