Iris Ohyama data cloud breach exposes info of 7.7 million customers

Iris Plaza, the online shopping platform operated by Japanese manufacturer Iris Ohyama, suffered unauthorized access through a third-party cloud service. The company found a suspicious file and later confirmed that an outside party had accessed the service. Customer information stored there may therefore have been available to unauthorized actors.

Exposure does not automatically mean every record was copied, published, or misused. It means the company cannot rule out unauthorized access to the data. Potentially affected information includes names, addresses, phone numbers, email addresses, gender, birth dates, and active-member passwords. Credit card information was not stored in the affected service.

The company has not finalized the number of exposed records or affected people. The possible impact reaches 5.8 million current and former members plus 1.9 million non-members. As of November 5, Iris Plaza had received no reports of misuse or financial loss, but the investigation continues.

The possible scale is large, but the company has not established an exact number of exposed records. Iris Plaza says the impact could extend to up to 5.8 million registered and former members and 1.9 million non-members. Together, those figures represent up to 7.7 million people, not necessarily 7.7 million confirmed exposed records.

The potentially accessed data varies by person. It may include full names, physical addresses, phone numbers, email addresses, gender, dates of birth, and account passwords. Passwords were stored only for active registered members. Former members did not have passwords stored, according to the company.

Iris Plaza says active-member passwords were encrypted, although it did not identify the encryption scheme. Credit card details were absent from the affected cloud service. The investigation is still determining how many records were exposed and how many individuals were actually affected.

If misused, the exposed details could make customers easier to identify, contact, impersonate, or target with convincing scams. Names combined with addresses, phone numbers, email addresses, gender, and birth dates provide a detailed personal profile. A password connected to an online account could also let an attacker try unauthorized access, especially if a customer reused it elsewhere.

The article does not report any confirmed customer harm. It says Iris Plaza had received no reports of misuse of the exposed information or financial loss by November 5. It also says credit card information was not stored in the affected cloud service, limiting the chance of direct card exposure through this incident.

Risk can remain even when misuse has not appeared immediately. Customers may need to watch for unusual messages, account activity, or password-reset notices. Iris Plaza is still investigating the number of affected records, while the company has not disclosed the password-encryption method.

Iris Plaza used an external, third-party cloud service as part of its online-store systems. The service stored customer data for the Iris Plaza shopping platform. The article does not state why Iris Ohyama selected that service, so its business or technical rationale cannot be confirmed from the available information.

The important connection is that the cloud service was not separate from the store’s customer operations. Iris Plaza discovered a suspicious file there and confirmed unauthorized access by a third party. Data held in that environment may have been accessed, including customer identities, contact details, and some account information.

This arrangement meant a security incident at the external service could affect Iris Plaza customers. The company suspended Iris Plaza and related systems while investigating. It also said credit card information was not stored in the affected service. The investigation continues to determine the precise number of exposed records and impacted people.

After finding a suspicious file in the external cloud service, Iris Plaza suspended the shopping platform and related systems. The company began an investigation and confirmed unauthorized access by a third party. It publicly disclosed the incident on October 29, after its initial discovery late the previous month.

The suspension covered Iris Plaza and the SIMPLE STYLE online store. It also affected websites for Iris Tech Service Co., Ltd., including home-appliance subscriptions and furniture and appliance delivery and installation. Taking these services offline reduced ongoing access while the company examined the compromised environment.

Japan’s Personal Information Protection Commission and police were notified on October 29, 2026. Iris Plaza is still determining the number of exposed records and affected individuals. A spokesperson said the company had received no direct communication from the attacker and had not identified the perpetrators. BleepingComputer also asked whether a ransom had been demanded.

Plain-text storage keeps a password in a readable form. Anyone who gains access to that database may be able to see the actual password immediately. Encryption transforms the stored value into protected data that is intended to be unreadable without the required key or process. Iris Plaza says active members’ passwords were encrypted, but it did not name the encryption scheme.

That protection reduces direct exposure, but it does not make stolen data harmless. Attackers may try to break weak protection, exploit implementation flaws, or obtain keys through another compromise. If recovered passwords are reused on other services, one stolen credential could create wider account risk.

The article confirms no passwords were stored for former members. It does not report password misuse or financial loss as of November 5. Customers should still treat any potentially exposed password as sensitive, especially where the same password was used elsewhere. Iris Plaza’s investigation may clarify the actual risk.

Companies remain responsible for deciding what personal data to store, who can access it, and how long it should be retained. They should use appropriate protections, restrict permissions, monitor unusual activity, investigate alerts, and prepare response plans. They also need to understand the security features and limits of any cloud service they use.

Cloud providers typically protect the underlying platform, infrastructure, and service operations. The customer usually controls its accounts, settings, stored data, and authorized users. In this case, Iris Plaza used an external cloud service, and a suspicious file was found there. The article does not say whether the weakness involved the provider, Iris Plaza’s configuration, stolen credentials, or another cause.

Both sides need clear responsibilities, testing, logging, and prompt incident coordination. Iris Plaza suspended systems, investigated, and notified Japanese authorities. The investigation has not identified the perpetrators or finalized the affected records, so the specific control failure remains unknown.