● Covered by 2 sources · 2 reportsMedium impact1 negative1 neutral
Iris Ohyama data breach exposes personal information of 7.7 million customers
Key points
- Iris Ohyama reported unauthorized access to a third-party cloud service.
- Data of up to 7.7 million customers potentially exposed.
- Exposed data includes names, addresses, phone numbers, emails, and encrypted passwords.
- Credit card information was not stored on the affected service.
- Iris Plaza is a Japanese online shopping platform.
- The incident was discovered on October 28.
- 5.8 million affected individuals are current and former members.
- 1.9 million affected individuals are non-members.
- Exposed data for members includes dates of birth and gender.
- Iris Ohyama suspended Iris Plaza and disconnected related systems.
- Iris Ohyama notified law enforcement and retained external experts.
Unauthorized Access to Cloud Service
Iris Ohyama, operator of the Iris Plaza shopping platform, confirmed unauthorized access to an external cloud service it utilizes. The company discovered a suspicious file in the service late last month, leading to an immediate suspension of Iris Plaza and related systems for investigation.
Customer Data Potentially Exposed
The investigation indicates that customer data stored in the compromised cloud service may have been accessed by unauthorized actors. The potential impact extends to approximately 5.8 million registered and former members, and 1.9 million non-members, totaling up to 7.7 million individuals.
Exposed information varies by individual but can include full names, physical addresses, phone numbers, email addresses, gender, dates of birth, and encrypted account passwords for active members. The company stated that credit card information was not stored on the affected cloud service.
Company Response and Notifications
In response to the incident, Iris Plaza's online store (SIMPLE STYLE) and associated systems, including those for Iris Tech Service Co., Ltd. (home appliance subscriptions, delivery, and installation), were suspended on October 28. Iris Ohyama notified Japan’s Personal Information Protection Commission and police on October 29, 2026. As of November 5, no reports of misuse of the exposed information or financial loss have been received.
Updates
- Iris Plaza is a Japanese online shopping platform.
- The incident was discovered on October 28.
- 5.8 million affected individuals are current and former members.
- 1.9 million affected individuals are non-members.
- Exposed data for members includes dates of birth and gender.
- Iris Ohyama suspended Iris Plaza and disconnected related systems.
- Iris Ohyama notified law enforcement and retained external experts.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Japanese online shopping platform Iris Plaza experienced a data breach on October 28, potentially exposing personal information for 7.7 million customers. The compromised data includes names, addresses, phone numbers, email addresses, dates of birth, gender, and encrypted passwords for members, and similar details for non-members.
Japanese manufacturer Iris Ohyama disclosed that personal information for up to 7.7 million customers may have been exposed due to unauthorized access to a third-party cloud service. The breach affects 5.8 million registered members and 1.9 million non-members, with data types including names, addresses, phone numbers, emails, gender, dates of birth, and encrypted passwords.