Iris Plaza breach: personal information on about 7.7 million people may have been exposed through a cloud service, encrypted passwords included
Iris Plaza, Iris Ohyama's online store, said on November 5, 2026 that personal information on about 7.7 million people — about 5.8 million members and former members and about 1.9 million non-members — may have been viewed or taken from an external cloud service it uses, including names, addresses, phone numbers, email addresses, dates of birth and encrypted passwords; credit card information was not stored in that service.
What happened
Iris Plaza, the official online store of Japanese manufacturer Iris Ohyama, found a suspicious file on October 28, 2026 in an external cloud service the store uses, and suspended Iris Plaza and related systems the same day. Its investigation confirmed unauthorised access by a third party, which it first disclosed on October 29, when it also reported the incident to Japan’s Personal Information Protection Commission and the police. In a second report on November 5, the company said customer data stored in that cloud service may have been viewed or acquired by the unauthorised actors, and it began notifying customers that day. The company says it blocked the access route; it has not announced a reopening date, and a spokesperson told BleepingComputer it received no direct communications from the attacker and has not identified who was responsible. As of November 5 it had received no reports of misuse of the information or of financial loss tied to the incident. The exact number of records actually exposed is still under investigation.
Who is affected
Up to about 7.7 million people whose information was stored in the affected cloud service: about 5.8 million registered members and former members of Iris Plaza, and about 1.9 million non-members, including guest shoppers and campaign participants. For members and former members, the information that may have been exposed is full names, addresses, phone numbers, email addresses, gender, dates of birth and passwords — the company says passwords were stored in encrypted form, that no passwords are stored for former members, and that the fields vary from person to person depending on what each person registered. For non-members, the fields are names, addresses, phone numbers and email addresses. The company says credit card information was not stored in the affected cloud service. Related group sites — the SIMPLE STYLE online store and Iris Tech Service websites for appliance subscriptions and furniture and appliance delivery — were also suspended on October 28 as a precaution, but neither operation has confirmed unauthorised access or a leak of its own.
How serious
The concrete risk is targeted phishing and account takeover, not direct card fraud: the company says no credit card data was in the cloud service, but names, home addresses, phone numbers, email addresses and dates of birth are enough for a scammer to pose as Iris Plaza with a believable delivery, refund or account message quoting real customer details. The password element raises the stakes for anyone who reused an Iris Plaza password elsewhere: the passwords were encrypted and the company has not disclosed the method used, so how hard they would be to crack is unknown, and a reused password that is cracked anywhere can be tried against email and shopping accounts. The company is still investigating how many records were actually viewed or taken, so the 7.7 million figure is the total whose data was stored in the service and may have been exposed — not a confirmed count of records copied.
What to do now
If you have or had an Iris Plaza account, change the password if you have reused it on any other service, starting with the email account tied to it, and turn on two-factor authentication where it is offered. The company warns customers to expect impersonation by email, text message, phone call, website and social media account; a genuine notification will never ask for a password, PIN or authentication code, so treat any message that does as a scam even if it quotes your real name or address. Do not click links in unsolicited messages — go to the company’s site by typing the address yourself. Because the store remains suspended with no reopening date announced, be wary of messages claiming an order, delivery or refund needs urgent action. Watch bank and card statements as a routine precaution, even though the company says card information was not stored in the affected service.
Sources: BleepingComputer, “Iris Ohyama data cloud breach exposes info of 7.7 million customers,” November 8, 2026 · CyberInsider, “Iris Plaza says cloud breach exposed data on 7.7 million customers,” November 5, 2026