Iris Ohyama Data Breach: Data on 7.7 Million Iris Plaza Customers May Have Leaked From a Cloud Service, What Is Confirmed and What to Check
Iris Ohyama says a third party got into an external cloud service used by its Iris Plaza online store, putting data on about 7.7 million people at risk. Here is what is confirmed, what is not, and what businesses should check this week.
On this page 7 sections
Iris Ohyama, the Japanese household goods and appliance maker, says personal information on about 7.7 million people may have leaked after a third party got into an external cloud service used by its online store, Iris Plaza. If your business keeps customer records in a cloud service that sits beside your website rather than inside it, this incident is worth a close look: the company's own update points to that outside storage, not the shop front.
We built this post from the company's two official notices, dated October 29 and November 5, 2026. Where something is not in those notices, we say so.
What happened in the Iris Ohyama data breach
Iris Plaza Co., Ltd. runs Iris Ohyama's official online store. According to its notices:
| Date (2026) | What the company says happened |
|---|---|
| Wednesday, October 28 | A suspicious file was found in an external cloud service. The Iris Plaza site and related systems were shut down and an investigation began. |
| Thursday, October 29 | First notice published. Police and Japan's Personal Information Protection Commission were notified. The company said no credit card leak had been found so far. |
| Thursday, November 5 | Second notice published, giving the 7.7 million figure. The company said it would begin contacting affected people that day. |
The company says it has blocked the route the intruder used and is working with outside experts and the authorities to find the full cause.
Three other services were also taken offline on October 28 as a precaution: SIMPLE STYLE, a home fashion store run by Iris Plaza, and the appliance subscription and furniture and appliance delivery and installation services run by group company Iris Tech Service. The company says it has found no unauthorized access or leaks for those services, or for Iris Plaza stores on other online marketplaces. As of the November 5 notice, no restart date had been announced.
What data was exposed in the Iris Plaza breach
The 7.7 million figure is the total number of people whose records were stored in the affected cloud service. The company says those records may have been viewed or taken, and that the actual number of leaked records and affected people is still under investigation.
| Group | Data that may have leaked | People |
|---|---|---|
| Members, including people who closed their accounts | Name, address, phone number, email address, gender, password, date of birth | About 5.8 million |
| Non-members (guest checkout or campaign entries) | Name, address, phone number, email address | About 1.9 million |
The company adds three qualifications: passwords for people who had closed their accounts are not included, some items including passwords are encrypted, and not every person's record contains every item. Credit card information was not stored in the affected cloud service, and the company says it confirmed card data was not affected.
What is confirmed and what is not
Confirmed by the company:
- A third party accessed an external cloud service used by Iris Plaza.
- Data on about 5.8 million members and 1.9 million non-members was stored there and may have leaked.
- Card data was not stored there.
- Police and the Personal Information Protection Commission were notified on October 29.
- As of November 5, the company had no reports of misuse or financial loss linked to the incident.
Not known yet:
- Which cloud service was involved, and how the intruder got in.
- How many records were actually taken. 7.7 million is the stored total, not a confirmed theft count.
- How the passwords were protected. The notice says "encrypted" but does not say whether they were hashed (stored in a form that cannot be turned back into the password) or encrypted in a way that could be reversed with a key.
- Who was responsible. No attacker or group has been named by the company.
Some early coverage described the passwords as stored with weak security. The company's notices do not say that, so we are not repeating it as fact.
What to do this week
If you or your staff ever shopped at Iris Plaza, and for any business that stores customer data in the cloud:
| Action | Who | How to check |
|---|---|---|
| Change any password that was also used at Iris Plaza | Anyone with an Iris Plaza account | Search your password manager for irisplaza.co.jp and change every other account that shares that password |
| Turn on stronger sign-in for work accounts | IT lead | Require an authenticator app or passkey on email, banking and admin logins, not just a password |
| Warn staff about follow-up phishing | Office manager | Iris Plaza says it will never ask for passwords, PINs or verification codes by email or text. Treat any message that does as fake |
| List every cloud service that holds customer data | Owner and IT lead | Include storage buckets, backups, spreadsheet exports, email marketing and form tools, not only your main database |
| Check who and what can reach that data | IT lead or developer | Review access keys, shared links, public settings and old staff accounts. Remove anything nobody can explain |
| Decide what you no longer need to keep | Owner | Old customers, closed accounts and expired campaign entries: delete what you have no reason to hold |
| Confirm how your site stores passwords | Developer | Passwords should be hashed with a slow algorithm built for passwords, such as bcrypt or Argon2, never stored in reversible form |
If you have an Iris Plaza account and want to confirm whether you were affected, the company lists a toll-free contact center (0120-108-824, weekdays and Saturdays, 9:30 a.m. to 5:00 p.m. Japan time), an email address (plaza_info@irisplaza.co.jp) and an FAQ on its notice page.
Why the Iris Ohyama breach matters for a business website or online store
Customer data often sits outside the main website. Online stores move data into other places all the time: exports for marketing, files for delivery partners, backups, analytics. Each copy lives in its own cloud service with its own access settings, and those are the places nobody is watching. Iris Plaza's notice points to exactly this kind of external service, not to the store's checkout.
Old data is still exposed data. The member count includes people who had closed their accounts, and 1.9 million records came from guest checkouts and campaign entries. Every record you keep after it stops being useful is one more record that can leak. A clear retention rule is cheaper than a breach notice.
Password reuse turns one breach into many. Even if Iris Plaza's passwords prove hard to crack, the names, emails and phone numbers alone are enough for convincing phishing. Where a password was reused, attackers will try it on email and banking accounts first. Our post on whether MFA stops stolen passwords explains why phone codes help, and why passkeys help more.
Downtime is part of the cost. The store and three related services were shut down on October 28 and had no restart date as of November 5. For any company that sells online, knowing where your data is and who can reach it is also what lets you get back online quickly. If you run your own servers or storage, our self-hosting and infrastructure page covers how we set that up so access is limited and logged.
Iris Ohyama data breach questions people are asking
How many people were affected by the Iris Ohyama data breach?
Records on about 7.7 million people were stored in the affected cloud service: about 5.8 million members and former members and about 1.9 million non-members. The company says the actual number leaked is still being investigated.
Was credit card information stolen?
No, according to the company. Card data was not stored in the affected cloud service, and Iris Plaza says it confirmed card information was not affected.
Were Iris Plaza passwords leaked?
Member passwords were in the affected data, except for people who had closed their accounts. The company says passwords were encrypted but has not said exactly how. Change any password you reused elsewhere.
Who hacked Iris Ohyama?
The company has not named an attacker, and its notices do not mention ransomware or a ransom demand. The cause is still under investigation.
Is the Iris Plaza website back online?
As of the November 5 notice, the site, SIMPLE STYLE and the Iris Tech Service sites remained suspended with no restart date announced. Check the company's news page for updates.
What should I do if I get an email about the breach?
Do not click links, open attachments or reply to unexpected messages about it. Iris Plaza says it will never ask for passwords, PINs or verification codes by email or text. Contact the company through the details on its official notice instead.
The bigger lesson
The Iris Plaza checkout was not the reported weak point. A cloud service holding a copy of customer data was. Most businesses that sell online have at least one of those: a bucket, a backup, an export, a marketing tool. Few have a list of them, a named person checking who can get in, or a rule for when old records get deleted. Making that list is a job for one afternoon, and it is what decides whether a suspicious file turns into a 7.7 million record notice.
Want that list built and the gaps closed? See security hardening or get a quote.
Get security alerts like this one by email, along with our free checklist, at /security-alerts.
Sources: Iris Ohyama: Second notice on the Iris Plaza EC site suspension, November 5, 2026; Iris Ohyama: Notice of temporary suspension of the Iris Plaza EC site, October 29, 2026.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Binance Hack: $6.3 Billion Taken After Engineers' Laptops Were Compromised, What Is Confirmed and What to Check This Week
Attackers took about $6.3 billion from Binance on October 29. Binance's preliminary findings trace the theft t...
Plex2Shell QNAP NAS Exploit: Attackers Compromise Plex Media Server on NAS Devices, the Fixed Version and How to Check Yours
QNAP says attackers have compromised Plex Media Server on some NAS devices using Plex2Shell, a four-flaw chain...
WordPress RCE Vulnerability CVE-2026-119977: CISA Confirms Exploitation of the Update Window Flaw, the Fixed Versions, and What to Do Before You Update
CISA lists WordPress flaw CVE-2026-119977 as exploited. It opens while a site updates and affects versions 4.7...
