Iris Ohyama Says Cloud Intrusion May Have Exposed Data of 7.7 Million People
Summary
Iris Ohyama says unauthorized access to a third-party cloud service may have exposed personal information of up to 7.7 million Iris Plaza customers. The company suspended affected services; no misuse or financial loss had been reported as of November 5.
Key points
- Iris Ohyama confirmed unauthorized access to an external cloud service used by its Iris Plaza online store.
- Information potentially exposed includes names, addresses, phone numbers, email addresses, gender, birth dates, and active members’ encrypted passwords.
- The potential impact covers up to 5.8 million registered and former members and 1.9 million non-members; the company is still determining the number of affected records and people.
- Credit card information was not stored in the affected service.
- The company suspended Iris Plaza and related services on October 28 and notified Japan’s Personal Information Protection Commission and police on October 29.
- As of November 5, the company had received no reports of misuse or financial loss; it had not identified the perpetrators or received direct communications from them.
Article Details
- Victim Organization
- Iris Ohyama
- Incident Type
- Confirmed unauthorized access to a third-party cloud service used by Iris Plaza, with customer data potentially accessed.
- Disclosure Date
- 2026-10-29
- Data Types Exposed
- Full names
- Physical addresses
- Phone numbers
- Email addresses
- Gender
- Dates of birth
- Account passwords
- Affected Records
- The company said the impact could extend to up to 7.7 million people: up to 5.8 million registered and former members and 1.9 million non-members. The number of exposed records and affected people was still being determined.
- Operational Impact
- Iris Plaza and related systems were suspended on October 28, 2026. The suspension also affected the SIMPLE STYLE online store and websites for Iris Tech Service Co., Ltd. services. The company said active members' passwords were stored in encrypted form; the encryption scheme was not specified. Credit card information was not stored in the affected cloud service. As of November 5, the company had received no reports of misuse or financial loss tied to the incident.
- Ransom Or Extortion
- The company spokesperson said it had received no direct communications from the attacker. No ransom demand was reported.
- Claim Status
- confirmed
Products
Iris PlazaJapanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to aSIMPLE STYLEIn response to the incident, the company’s online store (SIMPLE STYLE) and related systems were suspended on October 28.