Skip to content
audiotale.net
Sign in
NewsNews

Iris Ohyama data breach: Iris Plaza cloud leak may hit 7.7 million people

Iris Ohyama says unauthorized access to a third-party cloud service may have exposed contact details, and for members passwords, of up to 7.7 million people.

audiotale.net team

· 5 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. The numbers
  5. Background
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Iris Ohyama, the Japanese manufacturer behind the Iris Plaza online store, said on 5 November 2026 that up to about 7.7 million people may be affected by unauthorized access to an external cloud service it uses. The exposed fields include names, addresses, phone numbers and email addresses, and for registered members also gender, dates of birth and passwords. The company says credit card details were not stored in that service and that it has seen no reports of misuse so far.

Key points

  • Iris Plaza found suspicious files in a third-party cloud service on 28 October 2026, suspended its online store and related systems that day, and disclosed the incident on 29 October.
  • The company's 5 November update says up to about 7.7 million people may be affected: roughly 5.8 million registered and former members and 1.9 million non-members such as guest shoppers and campaign entrants.
  • For members the possible data is names, addresses, phone numbers, email addresses, gender, dates of birth and passwords (not for former members); for non-members it is names, addresses, phone numbers and email addresses.
  • Iris Ohyama says credit card information was not stored in the affected service, and as of 5 November it had received no reports of misuse or financial loss.
  • The company has not said how the third party got in, who is responsible, or how the passwords were protected, beyond saying that passwords and some fields were encrypted.

What to do

If you have, or ever had, an Iris Plaza account, or bought as a guest or entered a campaign:

  • Change the password on any other service where you used the same one. This is the company's own advice. Iris Ohyama says passwords were encrypted but has not named the method, so assume a determined attacker could recover weak ones.
  • Expect impersonation. Names, phone numbers, addresses and email addresses are exactly what scammers use to make an email, text or call convincing. The company warns about fake emails, texts, calls, websites and social media accounts, and says its genuine notices will never ask for passwords, PINs, authentication codes or other sensitive information.
  • Do not click links in messages that claim to be about this incident. Go to the company's own site, typed or bookmarked, and read the notice there.
  • Watch for unfamiliar logins on accounts that share your Iris Plaza email address, and turn on two-factor authentication where it is offered.
  • Do not expect the store back yet. Iris Plaza has no announced reopening date.

What happened

The following timeline is assembled from the company's notices as reported by BleepingComputer and CyberInsider. We could not open the company's own Japanese notice from our systems (the server refused our request), so we link its news page below and rely on those two reports, which agree with each other on every figure.

28 October. The company found a suspicious file in an external cloud service it uses and shut down Iris Plaza and related systems. SIMPLE STYLE, another online store, has been offline since the same day as a precaution.

29 October. It made a first, short announcement. It says it blocked the access route and notified Japan's Personal Information Protection Commission and the police the same day.

5 November. A fuller update confirmed unauthorized access by a third party and gave the scale: up to about 7.7 million people. It said the exact number of leaked records and affected people is still being determined and began notifying customers.

Two related sites, the Iris Tech Service websites, suspended some services and new applications. Neither Iris Tech Service nor Iris Plaza has confirmed unauthorized access or a data leak at those sites.

The numbers

The 7.7 million figure is a ceiling, not a confirmed count. It is the number of people whose records sat in the affected cloud environment. The company says it is still working out which records were actually taken.

People who may be affected by the Iris Plaza breach, by account type (up to)million people
People who may be affected by the Iris Plaza breach, by account type (up to) (million people)
million people
Registered and former members5.8
Non-members1.9

Source: Iris Ohyama notice of 5 November 2026, as reported by BleepingComputer and CyberInsider

The two groups lose different things. Members' records include gender, dates of birth and passwords as well as contact details. Non-members, people who checked out as guests or entered campaigns, have name, address, phone and email in the service, but no password.

Background

A "third-party cloud service" can mean many things: a customer-data platform, a campaign or survey tool, a marketing database or a storage bucket. The company has not said which it was, and it has not said how the attacker got access (stolen credentials, a misconfiguration and a vulnerability are all possible). We therefore avoid guessing. What the pattern does show is a familiar one: personal data kept at a vendor can be exposed without any attack on the company's own shop or servers.

Similar disclosures have come in recent weeks. We covered the DreamHost file-manager breach that exposed FTP and webmail credentials and the DigiCert incident in which archived customer IDs were readable on an exposed system. In each, the lesson was the same: know which of your suppliers hold copies of customer data, and how access to them is controlled.

What it means

For customers. The risk is phishing and social engineering more than card fraud, because payment data was reportedly elsewhere. Scams that use real contact details are persuasive, so scepticism toward unsolicited messages is the main protection.

For companies that run online shops. The numbers show how a single vendor-side incident can touch millions of people at once, including shoppers who never created an account. Guest-checkout and campaign data often outlives its purpose. Retention limits, field-level encryption for sensitive items and short-lived vendor credentials reduce what an incident can reach. These are general practices, not statements about what Iris Ohyama did or did not do.

For the company. A store shut since 28 October, with no reopening date, is a direct business cost.

What we don't know yet

  • How the attacker accessed the cloud service, and which service it was.
  • How many records were actually taken, as opposed to being present in the affected environment.
  • How the passwords were protected. The company says they were encrypted but has not named the scheme, so it is unclear how hard they would be to recover.
  • Who is responsible. The company says it has not received direct contact from the attacker, and whether a ransom was demanded is not known.
  • Whether the Iris Tech Service sites, which suspended some services, were affected. Neither has confirmed that.
  • When Iris Plaza will reopen.

What to watch next

Watch the company's news page for a final count, a post-incident report and any findings from Japan's Personal Information Protection Commission. Customers should also watch for the notifications the company said it has begun sending, and treat any message that is not on the company's own site with caution.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next