Iris Ohyama / Iris Plaza: third-party cloud breach exposes data of up to 7.7 million customers
Severity: high · Patch status: no-fix-needed · Since 2026-10-29
Iris Ohyama says unauthorized access by a third party to an external cloud service used by its Iris Plaza online store may have exposed personal data of up to about 7.7 million people: up to 5.8 million registered and former members and 1.9 million non-members. Suspicious files were found in that service on October 28, 2026, and the store and related systems were suspended. The company first disclosed the incident on October 29, when it also reported it to Japan's Personal Information Protection Commission and the police. Exposed fields vary by person; for members they can include name, address, phone number, email, gender, date of birth and account password. Member passwords are stored encrypted (the scheme is not specified), and former members' passwords are not held. The company says credit card data was not stored in the affected service. As of its November 5 update it had no reports of misuse or financial loss. A company spokesperson told BleepingComputer it had received no direct communication from the attacker and had not identified the perpetrators. The cloud provider and the intrusion method have not been disclosed, and the number of records actually leaked is still under investigation.
What to do
- If you are an Iris Plaza customer, change your password and watch for phishing using your exposed details
- Enable unique passwords and MFA on any accounts reusing Iris Plaza credentials
- Monitor for targeted phishing and identity fraud leveraging exposed PII
- Review third-party cloud service access controls and data minimization in your own supply chain
Sources
All live incidents on Threat Watch
