Science & Tech · Cybersecurity · 2 hrs ago
Iris Ohyama says data of up to 7.7 million people may be exposed
Iris Ohyama disclosed a customer data breach involving a third-party cloud service used by Iris Plaza, its Japanese online store.
Up to 7.7 million people may be affected, including registered and former members and people who were not members.
Names, addresses and other personal details may have been exposed, with the data varying by person.
Active members' passwords were stored in encrypted form, and credit card information was not kept in the affected service.
Iris Plaza said it had received no reports of misuse or financial loss by November 5, and suspended its online store and related services after discovering the incident.
The company is still investigating how many records were affected; it has not identified the attackers or received direct communication from them.
Iris Ohyama says data belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service.
The potentially affected people include up to 5.8 million registered and former members and 1.9 million non-members.
The data may include names, contact details, gender, birth dates and account passwords, depending on the individual.
The company says passwords for active members were stored in encrypted form and credit card information was not held in the affected service.
As of November 5, the company had received no reports of misuse or financial loss linked to the incident.
- Who
- Iris Ohyama, which operates the Iris Plaza shopping platform, disclosed the incident. Up to 7.7 million people may be affected.
- What
- Personal information may have been accessed after unauthorized access to a third-party cloud service.
- When
- The company disclosed the incident on October 29, 2026. It said it discovered the incident late the previous month.
- Where
- An external cloud service used by the Iris Plaza online store.
- Why
- The company confirmed that a third party gained unauthorized access. The motive is not stated.
This story does not have two clearly opposing sides.
Iris Plaza's online store and related systems were suspended.
Iris Ohyama disclosed the incident and notified Japan's Personal Information Protection Commission and police.
The company had received no reports of misuse of the exposed information or related financial loss.
- Potentially affected people
- About 7.7 million
- Registered and former members
- Up to 5.8 million
- Non-members
- 1.9 million
- Possible data
- Names, physical addresses, phone numbers, email addresses, gender, dates of birth and account passwords
- Credit card information
- Not stored in the affected cloud service
What people are saying
We immediately suspended Iris Plaza and related systems and began an investigation. We confirmed unauthorized access by a third party and disclosed it in our first notice on October 29,