Japanese manufacturer Iris Ohyama, operator of the Iris Plaza shopping platform, has revealed that personal information belonging to around 7.7 million people may have been exposed after unauthorized access to a third-party cloud service used by the company.
The company discovered the incident late last month and publicly disclosed with limited details, accompanied by an announcement that the site would be temporarily suspended.
In an update earlier this week, the company said it discovered a suspicious file in an external cloud service used by online store Iris Plaza.
“We immediately suspended Iris Plaza and related systems and opened an investigation. We confirmed the unauthorized access by a third party and disclosed it in our first notice on October 29,” (automatically translated) the the company said.
The investigation confirmed that customer data stored in the compromised external cloud service may have been accessed by unauthorized actors.
While the company is still trying to determine how many records were exposed and how many people were affected, it notes that the impact extends to 5.8 million registered members and former members, and 1.9 million non-members.
Iris Plaza is the online storefront of the Iris Ohyama Group, a leading Japanese manufacturer of household products ranging from storage units and LED lighting to household appliances and garden accessories.
According to the company’s notification, the following information may have been exposed:
- Full names
- Physical addresses
- Phone numbers
- Email addresses
- Gender
- Dates of birth
- Account Passwords
The types of data exposed vary between individuals. For example, no passwords are stored for old members.
Iris Plaza said it stored registered active member passwords in encrypted form, but did not specify which encryption system it used.
The company also said that credit card information was not stored in the affected cloud service.
As of November 5, Iris Plaza has not received any reports of misuse of the exposed information or financial losses related to the incident.
In response to this incident, the company’s online store (SIMPLE STYLE) and associated systems were suspended on October 28.
The same applies to websites offering Iris Tech Service Co., Ltd. services, including appliance subscriptions and delivery and installation of furniture and appliances.
The Japanese Personal Information Protection Commission and the police were informed on October 29, 2026.
BleepingComputer has contacted Iris Plaza to learn more about the attack and whether ransom payment was requested. A spokesperson told us they had not received any direct communication from the attacker and had not identified the perpetrators.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s happening with a 14-day read-only scan of Microsoft 365 or Google Workspace, without MX modifications.
