Iris Ohyama Cloud Breach Exposes Data of 7.7 Million Customers

Japanese manufacturer Iris Ohyama has disclosed a significant data breach, revealing that personal information for up to 7.7 million customers of its Iris Plaza online shopping platform may have been exposed. The incident, discovered late last month, stemmed from unauthorised access to a third-party cloud service.

The company, widely known for its household products, confirmed that a suspicious file was found within an external cloud service used by Iris Plaza. An internal investigation indicated that customer data stored there could have been accessed by unauthorised actors.

Customer Data Impact and Company Response

Iris Ohyama noted that the potential impact extends to approximately 5.8 million registered members and former members, alongside an estimated 1.9 million non-members. The types of personal data potentially exposed include full names, physical addresses, phone numbers, email addresses, gender, dates of birth, and account passwords.

Iris Plaza clarified in its disclosure that while active registered members’ passwords are stored in an encrypted format, no passwords were held for former members. The company also confirmed that credit card information was not stored within the affected cloud service, mitigating potential financial exposure.

Following the discovery, Iris Ohyama promptly suspended its Iris Plaza website, the SIMPLE STYLE online store, and related systems on 28 October. Services provided by Iris Tech Service Co., Ltd., such as home appliance subscriptions and delivery, also faced temporary suspension as a precautionary measure.

The company notified Japan’s Personal Information Protection Commission and local police about the incident on 29 October 2026, initiating regulatory and law enforcement involvement.

As of 5 November, Iris Plaza had not received any reports of misuse of the exposed information or financial losses directly linked to the breach. The company continues its investigation to ascertain the precise number of affected records and individuals. Perpetrators have not yet been identified, and Iris Ohyama has received no direct communication from them.

Customers are advised to remain vigilant against potential phishing attempts and to consider changing passwords for any online accounts where they may have reused the same credentials as their Iris Plaza account.