Iris Ohyama cloud breach exposes data on up to 7.7M people
Iris Ohyama says unauthorized access to a third-party cloud service may have exposed names, contact details, dates of birth and account passwords for up to 7.7 million people. No card data.
Japanese manufacturer Iris Ohyama says unauthorized access to a third-party cloud service it used may have exposed personal data on up to 7.7 million people tied to its Iris Plaza online store. The company's own disclosure is the primary source: see its November 5 notice (PDF, Japanese). No payment card data was stored in the affected service, and as of November 5 the company says it has seen no reports of misuse.
What happened
Iris Ohyama found a suspicious file in an external cloud service it relied on, discovered the problem in late October, and suspended its Iris Plaza online store and related service sites on October 28. It went public on October 29 with limited detail, then updated the figures on November 5. The company notified Japan's Personal Information Protection Commission and police on October 29.
The vendor has not named the cloud provider, and has not said how the account was accessed.
Who and what is affected
Current estimate is about 7.7 million people, which the company breaks down as:
- up to 5.8 million registered and former members, and
- about 1.9 million non-members.
Iris Ohyama stresses this is a ceiling, not a confirmed count — it is still determining how many records were actually exposed. Fields that may be involved:
- full names, physical addresses, phone numbers, email addresses;
- gender and date of birth;
- account passwords.
Scope caveats the company states directly: former members have no stored passwords; active members' passwords are encrypted (the company did not specify the scheme); and credit card information was not stored in the affected cloud service.
Exploitation status
No group has claimed responsibility, and Iris Ohyama says it has received no direct communication from an attacker — no ransom demand is mentioned. The company reports no confirmed fraudulent use of the data as of its November 5 update. Treat "no misuse yet" as a snapshot, not an all-clear: a 7.7-million-record set of names, addresses and birthdates is durable phishing and account-takeover fuel whether or not it surfaces on a leak forum today.
Action checklist
- If you hold an Iris Plaza account, change its password now, and change it anywhere you reused it — encrypted-at-rest is not the same as safe once the store is unknown.
- Watch for Japanese-language phishing that cites your real name, address or birthday to look legitimate; Iris Ohyama will not ask for passwords or card numbers by email.
- Former members: you have no password at risk, but your name, address, phone and birth date may be out — raise your bar for vendor-impersonation and delivery-themed lures.
- Operators running customer data in third-party SaaS or cloud buckets: inventory what personal data sits outside your own controls, confirm it is logged and alertable on anomalous access, and check whether your provider's breach would even reach you in a usable timeframe.
Context
This is the same failure shape that keeps producing eight-figure Japanese breaches: the exposed data sat in a third-party service, not the retailer's core systems, and the retailer learned of it by finding an artifact left behind rather than from its own alerting. It lands the same week as reporting on other cloud- and provider-mediated incidents — the Crédit Mutuel Arkéa heist reached the bank through a service provider's platform — and the common thread is the one most operators still under-instrument: the blast radius of a vendor you do not directly monitor. The number to act on here is not 7.7 million; it is however many of your own records live in a cloud service whose logs you have never read.