Iris Plaza Data Breach May Have Exposed 7.7 Million Customer Records
Share
Japanese online shopping platform Iris Plaza, operated by household products and appliance manufacturer Iris Ohyama, has disclosed a data breach that may have exposed the personal information of up to 7.7 million customers.
The incident, discovered on October 28, involved the compromise of an external cloud service used by Iris Plaza. Hackers reportedly gained unauthorised access to the service and may have stolen customer data from it.
Iris Ohyama immediately suspended the Iris Plaza platform and disconnected related systems following the discovery. The company has since launched an investigation into the attack, notifying law enforcement and relevant authorities.
Of the 7.7 million individuals potentially affected, 5.8 million are current and former platform members. Their compromised data may include names, addresses, phone numbers, email addresses, dates of birth, gender information, and encrypted passwords.
The remaining 1.9 million individuals are non-members who made purchases without registering on the platform. For these customers, names, addresses, phone numbers, and email addresses may have been compromised.
Iris Ohyama has clarified that the hacked external cloud service did not store credit card information, and no physical stores operated by Iris Plaza were affected by the incident. The company also stated that attacker access to the compromised service has been blocked.
While an investigation is ongoing with the assistance of external cybersecurity experts, Iris Ohyama has reported no instances of unauthorised use or financial damage resulting from this incident at the time of its disclosure.
The Iris Plaza platform remains offline as the company continues to investigate the root cause and implement necessary remediation measures. Additionally, Iris Ohyama temporarily suspended its home fashion store Simple Style, as well as home appliance subscription, delivery, and installation services, and new applications, as a precautionary measure, despite no evidence of compromise to these additional sites.
