Cloud

Iris Plaza: up to 7.7M customers in a cloud breach

By Yaali. November 9, 2026, 6 min read, Cloud, Identity, Threat intel.

Iris Ohyama's online store says data on up to 7.7 million people sat in a breached external cloud service. What leaked, what is unknown and what to check.

On November 5, Iris Plaza, the company that runs the official online store of Japanese household goods maker Iris Ohyama, said personal data on up to about 7.7 million people may have been viewed or taken from an external cloud service it uses. About 5.8 million of those are registered members, former members included. The other 1.9 million or so bought without registering or entered a campaign. The store has been offline since October 28, and there is still no date for it to reopen.

The 7.7 million is the size of the data set that sat in the breached service, not a count of confirmed victims. The company says the real number of records leaked is still under investigation and may change. Anyone who has ever bought from Iris Plaza, even once as a guest, should assume their name, address, phone number and email address are in that pool. Current members should assume their password is in it too.

What the company has said

On October 28, staff found a suspicious file in the external cloud service. They shut down the online store and its related systems the same day and started an investigation, which confirmed access by a third party. On October 29 the company published a first notice and reported the incident to the police and to the Personal Information Protection Commission (PPC), Japan's data protection regulator. The second notice on November 5 gave the numbers and began notifying customers, with individual emails to follow in turn.

The exposed fields differ by person:

• Current members: name, address, phone number, email address, gender, password and date of birth. The company says passwords and some other fields were encrypted.
• Former members: the same fields, but passwords are not included.
• Non-members (guest buyers and campaign entrants): name, address, phone number and email address only.

Credit card data was not stored in the affected cloud service, and the company says it was not touched. As of November 5 it had no reports of misuse or financial loss, and no sign of unauthorized access at its stores on outside marketplaces. It says it has blocked the route the attacker used.

On October 28 the group also took down, as a precaution, its SIMPLE STYLE home furnishing store and the sites of Iris Tech Service (appliance subscriptions, delivery and installation), which stopped taking new applications. No unauthorized access has been confirmed at either.

What has not been said

The company has not named the cloud vendor or the type of service. "External cloud service" could mean object storage, a hosted database, a file sharing platform or a software as a service (SaaS) tool that held an export. How the attacker got in (a stolen credential, a leaked access key, a misconfigured share or a flaw in the service) has not been published either.

"Encrypted" passwords can mean two very different things. Japanese notices use the same word, 暗号化, for reversible encryption and for one-way hashing. If the passwords were encrypted with a key that sat in the same tenant, or that the attacker also reached, they are as good as plain text. If they were hashed with a slow, salted algorithm such as bcrypt or Argon2id, weak ones can still be guessed offline but strong ones will hold. The company has not said which, so members should act as if their password is known.

A "suspicious file" suggests the attacker could write to the service as well as read from it, for example to stage data for download or leave a ransom note. That is our reading; the company has not described the file.

What attackers can do with this data

In the reporting we found, no group has claimed the attack and no data has been offered for sale. Names, home addresses, phone numbers and email addresses tied to a known shop are what a convincing delivery or refund lure needs. The company has warned about impersonation by email, SMS, phone, fake websites and social media accounts. Expect messages about an "order problem", a "refund for the incident" or a "password reset" that quote a real address.

If the member passwords can be recovered, credential stuffing (trying leaked email and password pairs on other sites) works against anyone who reused theirs. Dates of birth help with account recovery questions and phone support impersonation.

This comes during a run of large Japanese breaches. The So-net and plala breach disclosed in late October also exposed member passwords, and the government's October 9 cyber emergency advisories asked companies to delete data they no longer need and to check public access settings on cloud storage. Here, records of people who had already closed their accounts are part of the 5.8 million.

What to do as a customer

1. If you used your Iris Plaza password anywhere else, change it there now, starting with your email account. Use a different password for each service, and turn on multi-factor authentication (MFA) where it is offered.
2. Do not type a password, PIN or authentication code into any page reached from an email or SMS about this incident. Go to the store or app by typing the address yourself.
3. Treat calls that quote your address and messages offering compensation as suspect until checked through the official site.
4. When the store reopens, set a new, unique password there as well.

What to check in your own cloud tenants

Most companies keep customer data in services they do not run, such as a storage bucket for exports, a SaaS marketing tool or a campaign drive.

• Make a list of every external service that holds customer personal data, and who in the business owns each one. Include campaign tools and old exports, which are where guest and former member data tends to collect.
• Delete what you do not need. If a former member's record is kept only for accounting, keep the fields accounting needs and drop the rest.
• Turn on read logging before you need it. On AWS, S3 object reads only appear in CloudTrail if data events are enabled for the bucket. On Google Cloud, Data Access audit logs (DATA_READ) are off by default for most services. On Azure, send storage diagnostic logs to Log Analytics so you can query StorageBlobLogs | where OperationName == "GetBlob" by caller IP and identity.
• Block public access at the account level, not only per bucket. On AWS, aws s3control get-public-access-block --account-id <id> shows whether the account-wide block is on.
• Hunt for long-lived access keys and shared accounts. Rotate keys older than 90 days, remove keys nobody can explain, and require single sign-on with MFA for every console login to the SaaS tools on your list.
• Alert on new or changed objects you did not expect, such as archives or text files written by an unusual identity. A file nobody recognises was how Iris Plaza found this intrusion.
• Store passwords with a slow, salted hash (Argon2id, scrypt or bcrypt), never with reversible encryption, and keep them out of exports and analytics copies. Old hashes can be upgraded the next time each user logs in.

If you want an outside view of where your customer data lives and who can reach it, our cloud and Kubernetes security work covers storage and SaaS tenants, and security operations can take on the alerting. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

Sources: Iris Ohyama notice, November 5, CyberInsider, Business+IT (SBBIT), innovaTopia, NHK, SmartScope.