Cloud Security · Privacy
Iris Ohyama breach exposes data of 7.7 million customers
Iris Ohyama has disclosed a data breach that may have exposed the personal information of up to 7.7 million customers after attackers accessed a third-party cloud service.
Ross GrantUpdated 2 min read
The short version
Iris Ohyama, a well-known Japanese company, says hackers got into a cloud service it used for its online shop. This may have exposed names, addresses, and other personal details of up to 7.7 million people. No credit card details were leaked, and passwords for active users were encrypted. The company shut down the affected services and told the authorities.
By the numbers
- 7.7 millioncustomers potentially affectedBleepingComputer
- 5.8 millionregistered and former members affectedBleepingComputer
- 1.9 millionnon-members affectedBleepingComputer
What happened?
Iris Ohyama, a major Japanese manufacturer, disclosed that up to 7.7 million customers may have had their personal information exposed after attackers accessed a third-party cloud service used by its Iris Plaza online store. The breach was discovered in late October 2026, leading to the suspension of the online store and notification of Japanese authorities. The company says no credit card data was exposed and there have been no reports of misuse so far.
Who is affected
The breach impacts customers of Iris Plaza, the online shopping platform run by Japanese manufacturer Iris Ohyama. According to the company, up to 5.8 million registered and former members and 1.9 million non-members may have had their information exposed. The affected group includes people who have shopped or registered on Iris Plaza, as well as users of related services managed by Iris Tech Service Co., Ltd. [BleepingComputer (opens in a new tab)][SC Media (opens in a new tab)]
What was taken
The company says the exposed data may include full names, physical addresses, phone numbers, email addresses, gender, dates of birth and account passwords. The specific data exposed varies by individual. For example, passwords are not stored for former members. Iris Ohyama says passwords for active registered members were encrypted, but did not specify the encryption method. Credit card information was not stored in the affected cloud service, so it was not exposed in this incident. [BleepingComputer (opens in a new tab)][SC Media (opens in a new tab)]
How the attack worked
The breach began with unauthorised access to a third-party cloud service used by Iris Plaza. The company discovered a suspicious file in this external cloud environment late in October 2026. After confirming the unauthorised access, Iris Ohyama suspended its online store and related systems on 28 October. The company has not said exactly how the attackers gained access, and as of early November, the perpetrators have not been identified. [BleepingComputer (opens in a new tab)][SC Media (opens in a new tab)]
The response
Iris Ohyama suspended the Iris Plaza site and related services immediately after discovering the breach. The company notified Japan’s Personal Information Protection Commission and the police on 29 October 2026. As of 5 November, there have been no reports of misuse of the exposed data or financial loss linked to the incident. The company is still investigating and has not received any direct communication from the attacker, nor has it identified who was behind the breach. [BleepingComputer (opens in a new tab)][SC Media (opens in a new tab)]
What you should do
Customers who have used Iris Plaza or related services should be alert for phishing attempts or scams using their personal information. Even though passwords were encrypted, changing your password is a good precaution. Watch for suspicious emails or messages, and avoid clicking on links or sharing further personal details unless you are sure of the sender’s identity.
Why it matters
This breach affects millions of people who trusted a major retailer with their personal details. It highlights the risks companies face when using third-party cloud services to store customer data. Even if no financial loss has been reported yet, exposed information can be used for scams or identity theft.
Key points
- Up to 7.7 million people may have had personal data exposed.
- Attackers accessed a third-party cloud service used by Iris Plaza.
- No credit card data was stored or leaked in this breach.
- Passwords for active users were encrypted, but the method was not specified.
- Customers should watch for phishing and consider changing their passwords.
Sources
BleepingComputer
Reference
SC Media
Reference
