Iris Ohyama Data Breach Exposes 7.7 Million Customer Records
Share
Japanese manufacturer Iris Ohyama has disclosed a significant data breach affecting its Iris Plaza online shopping platform, potentially exposing the personal information of up to 7.7 million customers.
The company, a major producer of household products ranging from appliances to garden accessories, announced the incident following unauthorised access to a third-party cloud service it used. This external service stored data for the Iris Plaza online store.
Customer Data Compromised
Iris Ohyama discovered a suspicious file within the cloud service in late October 2026, leading to an immediate suspension of Iris Plaza and related systems. The company publicly disclosed the breach on 29 October, confirming unauthorised third-party access.
The ongoing investigation suggests that customer data stored in the compromised cloud service may have been accessed by the unauthorised actors. The breach is estimated to affect up to 5.8 million registered members and former members, alongside 1.9 million non-members of Iris Plaza.
The types of personal information potentially exposed include:
- Full names
- Physical addresses
- Phone numbers
- Email addresses
- Gender
- Dates of birth
- Account passwords (stored in encrypted form for active registered members)
Iris Ohyama clarified that credit card information was not stored in the affected cloud service. As of 5 November 2026, the company had received no reports of misuse of the exposed information or related financial loss.
Company Response and Regulatory Notification
In response to the incident, Iris Plaza’s online storefront (SIMPLE STYLE) and other associated systems, including websites for Iris Tech Service Co., Ltd. (covering home appliance subscriptions and furniture delivery), were suspended on 28 October 2026. The company has since published an official notice regarding the incident.
Japanese authorities, including the Personal Information Protection Commission and police, were notified of the breach on 29 October 2026. Iris Ohyama continues its investigation into the extent of the compromise and the perpetrators behind the attack, noting it has received no direct communications from the attackers.
