Iris Ohyama Cloud Breach Exposes Data of 7.7 Million Customers

Japanese manufacturer Iris Ohyama disclosed that personal data belonging to approximately 7.7 million individuals may have been exposed following unauthorised access to a third-party cloud service. The incident affects Iris Plaza, the group's online shopping storefront, impacting up to 5.8 million registered and former members alongside 1.9 million non-members. The breach was detected in late October 2026 after a suspicious file was found in the cloud service. While payment cards were not stored there, exposed details include contact information and encrypted passwords. Malaysian users suspecting suspicious communications can contact Cyber999 or call 997.

Key Facts

What Customer Information Was Exposed?

The compromised third-party cloud service contained personal details belonging to up to 7.7 million customers, spanning 5.8 million registered and former members and 1.9 million non-members. Exposed records include full names, physical addresses, telephone numbers, email addresses, gender, dates of birth, and account passwords, whilst credit card data was excluded.

According to the breach notification, the precise data types exposed vary by individual. Passwords belonging to active registered members were stored in encrypted form, though Iris Plaza did not disclose the specific cryptographic scheme utilised. In contrast, former members did not have passwords stored in the repository. Furthermore, financial records and credit card details were completely absent from the affected cloud storage environment.

Iris Plaza confirmed that credit card information was not stored in the affected cloud service.

Has the Stolen Data Been Misused?

As of 5 November, Iris Plaza confirmed it had received no reports of financial loss or data misuse resulting from the incident. The company identified unauthorised access following the discovery of a suspicious file, but it has received no direct ransom demands or communications from the unidentified perpetrators.

Iris Ohyama suspended the Iris Plaza platform alongside its SIMPLE STYLE online store and related systems on 28 October 2026. The shutdown extended to websites operated by Iris Tech Service Co., Ltd., covering domestic appliance subscriptions and installation services. Japan's Personal Information Protection Commission and law enforcement authorities were formally notified on 29 October 2026 as forensic investigations commenced.

Japan's Personal Information Protection Commission and police were formally notified of the unauthorised access on 29 October 2026.

What Should You Do?

No software patch or vendor update is applicable as this incident stemmed from an external cloud repository breach. Users and administrators should take the following precautions:

• Reset shared credentials: Active members should change their Iris Plaza passwords and update any identical passwords reused across other online accounts.
• Remain vigilant against phishing: Monitor incoming emails, phone calls, and SMS messages closely, as exposed contact details can facilitate targeted social engineering attacks.
• Report suspicious activities: In Malaysia, report fraudulent incidents or suspicious cyber activities to Cyber999 (MyCERT) or call the National Scam Response Centre at 997.

Common Questions

Were payment card details compromised in the breach?

No payment card details were compromised during the incident. Iris Plaza explicitly stated that customer credit card information was not stored in the affected external cloud service, restricting potential exposure to demographic details, contact records, and encrypted account credentials.

Which services were suspended following the incident?

Iris Ohyama suspended the Iris Plaza online storefront and its SIMPLE STYLE online store on 28 October 2026. The precautionary suspension also impacted service websites managed by Iris Tech Service Co., Ltd., which handle home appliance subscriptions, furniture deliveries, and electrical installations.

Are passwords of former members at risk?

Former members do not have passwords at risk because Iris Plaza does not retain passwords for inactive accounts. However, active registered members had passwords stored in an encrypted format, though the company has not publicly specified the exact encryption scheme applied to those credentials.

Sources and Methodology

This news dispatch is based exclusively on reporting published by BleepingComputer on 8 November 2026 (Iris Ohyama data cloud breach exposes info of 7.7 million customers). No independent vendor advisories, external technical disclosures, or secondary regulatory filings were consulted or verified in compiling this report.