Iris Plaza, the official online store of Japanese manufacturer Iris Ohyama, says personal information belonging to as many as about 7.7 million people may have been exposed after unauthorized access to an external cloud service the company used.
In a November 5, 2026 update, Iris Plaza Co., Ltd. said it found a suspicious file in that third-party cloud service on October 28, immediately suspended Iris Plaza and related systems, and confirmed unauthorized access by a third party. Its first public notice went out on October 29. Follow-up investigation found that customer data stored in the affected cloud service may have been viewed or obtained.
The company said the cloud service held personal information for about 7.7 million people in total. It has not yet fixed the actual number of records leaked or how many people were affected, and it said it had received no reports of misuse or financial loss tied to the incident as of November 5.
What may have been exposed
According to the November 5 notice, the possible exposure breaks down as:
- About 5.8 million members (including former members): name, address, phone number, email address, gender, date of birth, and password data, among other fields
- About 1.9 million non-members (people who bought without registering, or who entered campaigns): name, address, phone number, and email address
Iris Plaza said not every field applies to every person, and that passwords and some other items were stored in encrypted form. Former members do not have password data in the affected set. Credit card information was not stored in the compromised cloud service, the company said, and it has not confirmed related unauthorized access at Iris Plaza shops on outside e-commerce malls.
Sites taken offline
Iris Plaza remains suspended while the company works on root cause and preventive measures. Iris Plaza also suspended its home fashion site SIMPLE STYLE on October 28. Related Iris Tech Service sites for appliance subscription and furniture or appliance delivery were stopped the same day as a precaution; those services have not shown unauthorized access or data leakage so far, according to the notice.
Police and Japan’s Personal Information Protection Commission were notified on October 29. The company said it is starting customer outreach by email and other channels, and warned people that Iris Plaza will never ask for passwords, PINs, or authentication codes, or send links that request that information.
Customers who reused the same password elsewhere were urged to change it. The company also warned about phishing and fake sites or social accounts that may appear in the wake of the notice.
Third-party cloud and marketing platforms have become a recurring path into retailer and brand customer files. BreachNews previously covered similar vendor-side exposures at Suntory and in the ENGIE partner marketing tool incident.
