Iris Plaza Breach Exposes Data of 7.7 Million Customers
Share
Japanese online shopping platform Iris Plaza, operated by household products and appliance manufacturer Iris Ohyama, has disclosed a data breach that may have compromised the personal information of 7.7 million customers.
The incident, which involved the compromise of an external cloud service, was discovered on 28 October 2026. Iris Ohyama immediately suspended the Iris Plaza platform, disconnected related systems, and launched an investigation into the attack.
Customer Data Types Affected
Of the 7.7 million individuals potentially affected, 5.8 million are current and former platform members. Their compromised data may include names, addresses, phone numbers, email addresses, dates of birth, gender information, and encrypted passwords.
The remaining 1.9 million affected individuals are non-members who made purchases without registering on the platform. For these customers, the exposed data potentially includes names, addresses, phone numbers, and email addresses.
Iris Ohyama stated that the hacked external cloud service does not store credit card information, ensuring that financial details were not exposed in this incident. Furthermore, no physical stores operated by Iris Plaza have been affected.
Company Response and Ongoing Investigation
Following the discovery, Iris Ohyama moved swiftly to block the attackers’ access to the compromised service. The company has since notified law enforcement and relevant authorities in Japan and has engaged external experts to assist with the investigation.
Iris Plaza remains offline while Iris Ohyama continues to investigate the root cause of the incident and applies necessary remediation measures. The company has reported that, at this time, there have been no confirmed reports of unauthorised use of the exposed data or financial damage directly resulting from the breach.
In a precautionary move, the manufacturer also temporarily suspended its home fashion specialty store Simple Style, the Iris Group’s home appliance subscription, delivery, and installation services, and new applications to the site. Iris Ohyama clarified that there is currently no evidence these additional services were compromised.
