Iris Ohyama warns cloud security lapse exposed data on roughly 7.7 million shoppers

Japanese consumer goods maker Iris Ohyama disclosed that unauthorized access to an external cloud service may have exposed personal information belonging to approximately 7.7 million customers of its Iris Plaza shopping platform. The breach affects up to 5.8 million current and former registered members, alongside 1.9 million non-members. Iris Ohyama discovered a suspicious file in the cloud service late last month, prompting an immediate investigation and system shutdown. [2][3]

Potentially compromised information includes full names, physical addresses, phone numbers, email addresses, gender, dates of birth, and account passwords. Iris Plaza noted that passwords for active members are stored in encrypted form, former members have no passwords on file, and credit card information was not hosted on the breached cloud service. The company took down Iris Plaza, its SIMPLE STYLE storefront, and Iris Tech Service sites on October 28. [3]

Authorities, including Japan's Personal Information Protection Commission and police, were alerted on October 29, 2026. A spokesperson told BleepingComputer that Iris Plaza has not received ransom demands or direct messages from the attackers, who remain unidentified. The company had received no reports of financial damage or data misuse as of November 5. [3]