Iris Plaza Breach May Have Exposed Data of 7.7 Million People
Summary
Iris Ohyama says a breach discovered October 28 may have exposed personal data of 7.7 million Iris Plaza customers and non-members. The platform remains offline as the company investigates and applies remediation.
Key points
- Iris Ohyama says it discovered the incident on October 28 and suspended Iris Plaza, disconnecting related systems.
- The 5.8 million current and former members potentially affected may have had names, contact details, birth dates, gender information and encrypted passwords exposed.
- Another 1.9 million non-members who made purchases may have had names, addresses, phone numbers and email addresses exposed.
- The company says the external cloud service did not store credit card information and that no Iris Plaza-operated stores were affected.
- Iris Ohyama says it blocked the attackers’ access, notified authorities and retained external experts; it reports no known unauthorized use or financial damage.
- Iris Plaza remains offline. Other services and new applications were suspended, though the company says it has no evidence those sites were also compromised.
Article Details
- Victim Organization
- Iris Ohyama
- Incident Type
- Suspected data breach involving a hacked external cloud service
- Data Types Exposed
- Names
- Addresses
- Phone numbers
- Email addresses
- Dates of birth
- Gender information
- Encrypted passwords
- Affected Records
- Up to 7.7 million people potentially affected: 5.8 million current and former members and 1.9 million non-members.
- Operational Impact
- Iris Plaza was suspended and related systems disconnected. The platform remained offline during the investigation and remediation. Simple Style, subscription and delivery and installation services, and new applications to the site were also suspended, although the company said it had no evidence those sites were compromised. No Iris Plaza-operated stores were affected.
- Claim Status
- alleged