Threat watch / Breach
Iris Ohyama: data of about 7.7 million online store customers may have leaked
Iris Plaza, the online store of the Japanese home goods maker Iris Ohyama, found suspicious files in an external cloud service it uses on October 28. It confirms unauthorised access by a third party and says data on about 7.7 million people may have been viewed or taken. Card data was not stored there.
- Sector
- Retail
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- Unauthorised access by a third party to an external cloud service the company uses, where suspicious files were found on October 28. The company says it "blocked the unauthorised access route" but does not say what it was.[1][2] Checked 8 Nov 2026
- What was stolen
- Data that "may have been viewed or acquired": for members (including former members), name, address, phone number, email address, gender, date of birth and password (not for withdrawn members); for non-members, name, address, phone number and email address. Passwords were stored encrypted; the method is not disclosed. Credit card data was not stored in the cloud service and was not affected.[1][2][3] Checked 8 Nov 2026
- Who was impacted
- About 5.8 million members and former members and about 1.9 million non-members, about 7.7 million in total, as of November 5. The company says the actual number of people affected is still under investigation and that it had no reports of misuse.[1][2][3] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- Iris Plaza finds suspicious files in an external cloud service it uses and suspends its online store and related systems. Two other group sites are suspended as a precaution. [1][2]
- First notice: the company confirms unauthorised access by a third party and reports it to the police and to Japan's Personal Information Protection Commission. [1][2]
- Second notice: about 7.7 million people's data may have been viewed or taken. Emails to affected customers start that day. [1][3]
- BleepingComputer reports that, according to a spokesperson, the company has had no direct contact from an attacker and has not identified who is behind the attack. [2]