Iris Ohyama: 7.7 million shoppers exposed

Iris Plaza Co. told customers on November 5, 2026, that an external cloud service behind its online store may have given up personal data on about 7.7 million people. The store is the official shop of the Iris Ohyama group, a Japanese maker of household goods. Staff found a suspicious file in that cloud on October 28 and took the shop, and the systems tied to it, offline the same day.

A first public note on October 29 said a third party had reached the service. Police and Japan’s Personal Information Protection Commission were notified that day. The November 5 update is the one that puts a number on the archive. Iris Plaza says the file set covers about 5.8 million members, including people who had already closed their accounts, and about 1.9 million non-members, a group that includes guest buyers and people who entered a campaign. The company says it has confirmed that those records may have been viewed or taken. It is still counting how many actually left, and how many people that is. As of the November 5 notice, it had no report of misuse or of money lost because of the incident.

What the cloud held

For members, the fields that may have been exposed are a name, a physical address, a phone number, an email address, gender, a date of birth, and a password, plus whatever else that person had registered. Not every account holds every field. People who had already left the membership are outside the password column. Passwords that were stored were encrypted. Iris Plaza has not said which method it used.

Non-members are a shorter record: name, address, phone, and email.

Card numbers were not kept in the cloud service that was reached, and Iris Plaza says that part of the estate was untouched. Shops the company runs on other online malls have not, on its account, shown the same unauthorized access or a leak. A spokesperson told BleepingComputer the company had received no direct message from an attacker and had not identified who got in.

What is still dark, and what shoppers should do

Iris Plaza has not set a reopen date. It says it will publish one after the cause is identified and the controls meant to stop a repeat are in place. SIMPLE STYLE, the group’s home-fashion shop, has been offline since October 28 as a precaution. Iris Tech Service stopped its appliance-subscription site and its furniture and appliance delivery-and-install site the same day, and it stopped taking new applications. The company says those two services have not shown unauthorized access or a leak. They stay closed until a restart is announced. BleepingComputer’s November 8 report still had no date for the main store.

If an Iris Plaza password was also used anywhere else, change it on those other services now. The public notice says the stored passwords were encrypted and does not name the method, so a reused password stays a live credential until it is replaced. Former members are outside that password set. They are still inside the name, address, phone, and mail set.

Individual notices began on November 5 and will continue by email as the review names people. Iris Plaza says a genuine notice will not ask for a password, a PIN, or an authentication code, and it will not send people to a link in mail or SMS to type those in. A message that does is the follow-on this archive makes cheap. Read the company’s own site, or a bookmark already saved, until Iris Plaza publishes a reopen date. A “the store is back, sign in here” mail is the lure while the shop is dark.

Watch for new-account attempts, delivery texts, and refund calls that quote a home address and a household-goods purchase. Card data was not in the cloud. The contact data was. That is enough for a lookalike.

Retail teams that keep a customer archive in someone else’s cloud can read the cutoff as the model: a suspicious file on October 28, the shop offline the same day, regulators and police the next. The open item for Iris Plaza’s own customers is narrower. The count of who was actually read is unfinished, and the password protection is undescribed. Rotate the reused password before that count arrives.

This briefing relies on public reporting by BleepingComputer and on Iris Plaza’s November 5 notice.