Japanese manufacturer Iris Ohyama has said a breach of a third-party cloud service may have exposed personal information belonging to up to 7.7 million customers, but it remains unclear whether any data was stolen. Iris Plaza said it had received no reports of misuse as of November 5.
The company discovered a suspicious file in an external cloud service used by the Iris Plaza online store on October 28 and immediately suspended the website and related systems. The next day, it disclosed the incident and notified Japan’s Personal Information Protection Commission and police. An investigation confirmed unauthorized access by a third party.
Iris Ohyama now says the potentially affected data includes information on up to 5.8 million registered members (including former members) and 1.9 million non-members who made purchases or took part in promotional campaigns. The exposed data varies per individual but could include names, addresses, phone numbers, email addresses, dates of birth, gender, and, for active members, account passwords stored in encrypted form. The company said it does not keep credit card information in the affected cloud service and that no payment data was compromised.
Iris Ohyama, a major Japanese manufacturer of household products, has not identified the perpetrators and said it received no direct communications from the attacker. The company’s online store remains suspended, and it has not said when service will be restored. Orders are delayed, and customers cancelling purchases have been told they may need to refuse delivery if the parcel arrives before the cancellation is processed. However, the company’s stores on other platforms, including Rakuten, Yahoo! Shopping, and auPAY Market, are still operating.
The company has advised customers to watch for phishing emails, fraudulent calls, and fake websites, and to change any passwords they used elsewhere that match their Iris Plaza password.
Analysis
Why This Matters
- Scale of exposure: The full personal data of up to 7.7 million individuals may have been accessed, making this one of the largest breaches affecting a Japanese consumer company.
- Trust and service suspension: The indefinite shutdown of Iris Plaza disrupts customers and raises questions about reliance on third-party cloud services.
- Uncertainty persists: Without confirmation that data was stolen, the true impact remains unknown, but affected customers face ongoing risk of phishing and identity fraud.
Background
Iris Ohyama is a Japanese manufacturer and retailer selling home appliances, storage solutions, lighting, and pet supplies through its Iris Plaza online store. The breach was discovered in late October and publicly disclosed on October 29.
What to Watch
- Whether any of the exposed data emerges for sale on criminal forums or is used in targeted phishing campaigns.
- The timing of the restoration of Iris Plaza and any changes to the company’s cloud security posture.
- Potential regulatory scrutiny from Japan’s Personal Information Protection Commission and any subsequent fines or requirements.
Checked
12 claims in this story checked against 2 sources: 12 supported.
Show each claim
- SupportedThe breach may have exposed 7.7 million records.www.theregister.com - Articles: “Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk.”
- SupportedIt remains unclear whether any personal information was stolen.www.theregister.com - Articles: “It remains unclear whether the attackers actually made off with any personal information.”
- SupportedThe online store remains down while the investigation continues.www.theregister.com - Articles: “Meanwhile, Iris Plaza's website is still down, and the company isn't saying when it'll be back. [...] Iris Plaza says it is still investigating the possibility of a data leak and has yet to establish the full extent of the intrusion.”
- SupportedIris Plaza had received no reports of misuse as of November 5.BleepingComputer: “As of November 5, Iris Plaza had received no reports of misuse of the exposed information or financial loss tied to the incident.”
- SupportedThe company discovered a suspicious file on October 28.www.theregister.com - Articles: “The retailer, which sells everything from home appliances and furniture to pet supplies, first disclosed the incident on October 29, a day after discovering a suspicious file on a third-party cloud service used by its Iris Plaza ecommerce operation.”
- SupportedThe incident was disclosed and Japan’s Personal Information Protection Commission and police were notified on October 29.BleepingComputer: “Japan’s Personal Information Protection Commission and police were notified on October 29, 2026.”
- SupportedThe investigation confirmed unauthorized access by a third party.BleepingComputer: “We confirmed unauthorized access by a third party and disclosed it in our first notice on October 29,” [machine translated] the company said.”
- SupportedThe potentially affected data covers up to 5.8 million registered members and former members, plus 1.9 million non-members who bought products or joined promotional campaigns.www.theregister.com - Articles: “the potentially compromised cloud environment contained personal information belonging to approximately 5.8 million registered customers, including former members, and another 1.9 million people who had purchased products without creating an account or participated in promotional campaigns.”
- SupportedPotentially exposed information varies by person and may include names, addresses, phone numbers, email addresses, dates of birth, gender and account passwords.BleepingComputer: “According to the company's notification, the following information may have been exposed: Full names Physical addresses Phone numbers Email addresses Gender Dates of birth Account passwords The exposed data types vary per individual.”
- SupportedPasswords for active members are stored in encrypted form.BleepingComputer: “Iris Plaza said it stores passwords for active registered members in encrypted form, though it did not specify which encryption scheme it uses.”
- SupportedThe company says it does not store credit card information in the affected cloud service and that payment information was not compromised.www.theregister.com - Articles: “the retailer says it didn't store payment information in the affected cloud service and that it hasn't been compromised.”
- SupportedThe company has not identified the perpetrators and received no direct communications from the attacker.BleepingComputer: “A spokesperson told us that they received no direct communications from the attacker and have not identified the perpetrators.”
