Iris Plaza Co., Ltd. runs Iris Ohyama's official online store. The Sendai-based retailer says an unknown third party got into an external cloud service it uses, and that personal data on about 7.7 million people stored there may have been viewed or taken. The company's second notice, published on 5 November 2026 on the Iris Ohyama group website, splits the total into about 5.8 million members (including former members) and about 1.9 million non-members, such as guest buyers and people who entered campaigns. Member records include passwords, which the company says are encrypted. Every outlet covering the incident uses the same figures. The company stresses that 7.7 million is the number of people whose data was stored in the service, not a confirmed count of people whose data leaked. Its investigation into the actual number is still going on. No attacker has been named, and the company says it has had no reports of misuse or financial loss.
What Happened
The company gives this timeline:
- 28 October 2026: Staff found a suspicious file in the external cloud service. Iris Plaza immediately took its online store and related systems offline, cut off the route the intruder used, and began investigating.
- 29 October 2026: The investigation confirmed unauthorised access by a third party. Iris Plaza published its first notice and reported the incident to the police and to Japan's Personal Information Protection Commission. Nikkei reported the store's suspension the same day, according to Aliasfleet.
- 5 November 2026: The second notice said data held in the cloud service may have been leaked, and gave the categories of data and headcounts for the first time. Nikkei and Kyodo carried the news.
The shutdown reaches beyond the main store. The SIMPLE STYLE home-fashion shop, also run by Iris Plaza, has been offline since 28 October. On the same day, sister company Iris Tech Service took down the sites for its appliance subscription service and its furniture and appliance delivery-and-installation service, and stopped taking new orders. The company says it has found no unauthorised access or leakage at either service and calls the shutdowns precautionary.
Iris Plaza's shops on third-party marketplaces are not affected, the company says. NEXSIGHT Cyber Wire reports that the Rakuten Ichiba, Yahoo! Shopping and au PAY Market stores stayed open throughout. No date has been given for the main store to reopen. The company says it will reopen only after it has found the cause and put measures in place to stop it happening again.
What Was Taken
As of 5 November, the company lists two groups of data that may have been exposed:
- Members, about 5.8 million (including people who have closed their accounts): name, address, phone number, email address, gender, password, date of birth "and other" fields. Former members' records do not include passwords.
- Non-members, about 1.9 million (guest buyers and campaign entrants): name, address, phone number and email address.
The company says not every record contains every field, because what was stored depends on what each person registered. It says passwords and "some other fields" were encrypted. CyberInsider and Security Measures Lab both point out that it has not said what encryption or hashing was used. That matters: reversible encryption with a key that may also have been exposed is a very different risk from salted, slow password hashing.
Credit card data was not stored in the affected cloud service and was not affected, according to the company. Aliasfleet reports that the data goes back to customers who registered as early as May 2001. The company's notice does not state that date.
Why It Matters
- The data is ideal for convincing phishing. Each record ties a real name, home address and phone number to an email address, and to a store the person really used. That lets criminals send email, text and phone scams that look like genuine Iris Plaza messages, including fake "breach compensation" or "reset your password" messages. The company has warned that it will never ask for passwords, PINs or verification codes, and will never ask people to enter them through links in emails or texts.
- Password reuse turns this into an attack on other sites. About 5.8 million member records include passwords. If the protection is weak or can be undone, attackers will try those email-and-password pairs on banks, marketplaces and email providers. The company's main advice to members is to change the password on any other service where they used the same one.
- Old records add to the damage. Former members and one-time guest buyers make up a large share of the total, and some of them may not remember ever shopping with Iris Plaza. Keeping data for years after a customer leaves makes any breach bigger.
- The investigation is still running. The headcount could fall once the company confirms what was actually taken. The list of exposed fields could also grow, given the open-ended "and other" in the member data.
The Attack Technique
Very little is public. The company has confirmed unauthorised access to an external cloud service and the discovery of a suspicious file on 28 October. It has not named the cloud provider, how the attacker got in, or how long they had access. Aliasfleet notes that neither the cloud service nor the attack method has been identified. No group has claimed responsibility, and the stolen data has not been reported on any leak site. The company says it is investigating with outside experts and the relevant authorities.
Finding a "suspicious file" in a cloud store, followed by a broad shutdown of connected systems, fits several possible attacks: stolen or leaked cloud credentials, a misconfigured storage bucket, or an attacker staging files before stealing data or launching ransomware. None of these has been confirmed. Treat any of them as unproven until the company publishes its findings.
What Organizations Should Do
- Check the access settings and credentials on your cloud storage. List every bucket and database outside your main environment that holds customer data. Confirm nothing is open to the public, remove old access keys, and require multi-factor authentication for all admin and console accounts.
- Protect passwords with modern hashing, not reversible encryption. Use salted, slow hashing such as Argon2id, bcrypt or scrypt. Never keep encryption keys in the same place as the encrypted data. After a breach, say publicly which method you used so customers can judge their risk.
- Delete data you no longer need. Set retention limits for former members and guest buyers. Records from people who left years ago should be deleted or anonymised, not kept in active cloud storage.
- Watch for file changes in cloud storage. Turn on object-level logging. Alert on new or unexpected files and on large downloads. Practise a shutdown plan like the one Iris Plaza used, so you can isolate connected systems quickly.
- Prepare customers before scammers reach them. Publish a clear "we will never ask for" statement, verify your sending domains with SPF, DKIM and DMARC, and set up a phone line. If you run login services, watch for credential-stuffing attempts using email addresses from this breach.
- Check your outside providers. Iris Plaza's data sat in an external service, not on its own servers. Make sure contracts with cloud and SaaS providers require them to tell you about security incidents promptly and to share logs, and test that they actually do.
Sources: Iris Plaza: Data on About 7.7M People May Have Leaked ITD | （第2報）株式会社アイリスプラザECサイト一時停止のお知らせ｜2026年｜ニュース｜企業情報｜アイリスオーヤマ | Iris Plaza says cloud breach exposed data on 7.7 million customers | Iris Plaza breach may expose 7.7 million customer records | アイリスプラザ、約770万人分の個人情報漏えいの可能性 会員約580万人分にはパスワードも含むおそれ、公式第2報セキュリティニュースの... | Potential leak of approximately 7.7 million records from Iris Ohyam... | 「アイリスプラザ」に不正アクセス — 公式通販サイトを一時停止、クレカ情報の流出は現時点で確認なし NEXSIGHT CYBER WIRE | アイリスプラザ、最大770万人分の個人情報が流出の恐れ 生年月日やパスワードも対象（ビジネス＋IT） - Yahoo!ニュース