Iris Plaza cloud breach: Iris Ohyama — attackers accessed third-party cloud holding 7.7M customer records; store offline
Severity: high · Patch status: no-fix-needed · Since 2026-11-09
Japanese homeware and appliance maker Iris Ohyama discovered unauthorized access to a third-party cloud service used by its Iris Plaza ecommerce platform on October 28, 2026, and suspended the site the next day. Potentially exposed data covers ~5.8 million current and former registered members (names, addresses, phone numbers, emails, dates of birth, gender, encrypted passwords) and ~1.9 million non-members (names, addresses, phone numbers, emails). Payment card data was not stored in the affected cloud and was not compromised. It remains unclear whether data was actually exfiltrated; no unauthorized use or financial damage has been reported. Iris Plaza remains offline with no reopening date, orders are delayed, and the company has notified authorities, engaged external experts, and warned customers about phishing. Attack vector and cloud provider not yet disclosed.
What to do
- If you are an Iris Plaza customer, change any reused passwords on other services immediately
- Watch for phishing emails, fraudulent calls, and fake Iris Ohyama websites impersonating the retailer
- Organizations using third-party cloud services for customer data: review access controls, logging, and data minimization in those environments
- Verify whether your data was among the exposed records once Iris Ohyama completes individual notifications
- Monitor for follow-up disclosures on exfiltration scope and the intrusion vector
Sources
All live incidents on Threat Watch
