Iris Ohyama Cloud Breach Hits 7.7M Records

For shoppers on Iris Plaza, the storefront simply stopped working. Behind that suspension, according to an update from parent company Iris Ohyama, was something more serious: a suspicious file found in an external cloud service used by the online store, and evidence that someone had gotten in.

The Japanese manufacturer now says personal information belonging to about 7.7 million people may have been exposed. The figure is still being refined as the investigation continues, but the company has already put a shape on it: up to 5.8 million registered members and former members, plus 1.9 million non-members.

Iris Ohyama disclosed the incident with limited detail at first, then added more in an update earlier this week. What follows is what the company has actually said — and, just as importantly, what it has not.

How the discovery unfolded

Iris Ohyama says it discovered the incident late last month. In its update, the company said it had found a suspicious file in an external cloud service used by the Iris Plaza online store.

“We immediately suspended Iris Plaza and related systems and began an investigation. We confirmed unauthorized access by a third party and disclosed it in our first notice on October 29,”

— Iris Ohyama, in a machine-translated company statement

The first public notice went out on October 29. That notice was sparse, paired with an announcement that the site would be temporarily suspended. The follow-up this week filled in the customer-data side of the picture: the investigation confirmed that customer data stored in the compromised external cloud service may have been accessed by unauthorized actors.

The company's own account places the discovery and the disclosure close together, with systems taken offline before the investigation began in earnest.

What was actually in the cloud

According to the company's notification, the information that may have been exposed includes full names, physical addresses, phone numbers, email addresses, gender, dates of birth, and account passwords.

Not every person's record contains every field. Iris Ohyama says the exposed data types vary per individual, and gives one concrete example: no passwords are stored for former members.

For active registered members, Iris Plaza says passwords are held in encrypted form. The company did not specify which encryption scheme it uses.

One category the company explicitly rules out: credit card information. Iris Ohyama says payment card data was not stored in the affected cloud service.

The two populations behind 5.8 and 1.9

The split between registered and non-registered people matters for anyone trying to work out whether they are in the affected set.

• 5.8 million registered Iris Plaza members and former members may be affected.
• 1.9 million non-members may be affected.
• Combined, the company puts the possible exposure at about 7.7 million people.
• The first public notice was published on October 29.

The presence of non-members in the data is consistent with how retail platforms accumulate records — orders can be placed, or addresses captured, without a full account. The company has not itemized which fields apply to which group beyond the note about former members and passwords.

Iris Ohyama says it is still working to determine the number of records exposed and how many people are impacted. The 7.7 million figure is therefore a ceiling based on what the company knows so far, not a final count.

A storefront and its neighbors go offline

The suspension reached beyond the Iris Plaza store itself. Iris Ohyama says its online store SIMPLE STYLE and related systems were suspended on October 28.

The same applied to websites for Iris Tech Service Co., Ltd. services, including home appliance subscriptions and furniture and appliance delivery and installation.

That breadth reflects how the group's consumer-facing operations are wired together, but it also gives customers a practical marker: if they used any of those services around the end of October, the outage and the data notice are connected.

Regulators and police brought in

Iris Ohyama says Japan's Personal Information Protection Commission and police were notified on October 29, 2026.

As of November 5, Iris Plaza had received no reports of misuse of the exposed information or financial loss tied to the incident.

The company has also been asked directly about the attacker's side of the story. BleepingComputer contacted Iris Plaza to learn more about the attack and whether a ransom payment had been demanded. A spokesperson told the outlet that the company had received no direct communications from the attacker and had not identified the perpetrators.

Those two statements — no misuse reports, no contact from the attacker — are the clearest signals in the disclosure so far about what the company believes it is dealing with. Neither rules out later developments, and the investigation is described as ongoing.

What is known about the intrusion itself

The confirmed facts about the intrusion are narrow. Iris Ohyama says it found a suspicious file in an external cloud service. It confirmed unauthorized access by a third party. It says customer data stored in that service may have been accessed.

Beyond those points, the company's public notices do not describe the mechanics. There is no account of how the access was achieved, no description of the contents of the suspicious file, and no stated duration for the unauthorized access. The identity of the cloud provider operating the service is likewise not named in the disclosure.

Iris Plaza is the online storefront for the Iris Ohyama Group, a major Japanese manufacturer of household products ranging from storage units and LED lighting to home appliances and garden accessories. The company's publicly disclosed first notice and its company said follow-up update are the primary record of what it has chosen to release.

Passwords, encrypted or not

The password question is the one most likely to matter to individual customers, and the company's answer is partial.

Iris Plaza says passwords for active registered members are stored encrypted. It does not name the encryption scheme. For former members, no passwords are stored at all.

That leaves a straightforward gap in what customers can assess on their own: the company describes protection but does not describe its strength. Encrypted storage is not the same as an assurance that a credential cannot be recovered, and the disclosure does not go further than saying the data is encrypted.

The other exposed fields — names, addresses, phone numbers, email addresses, gender, and dates of birth — are the raw material for identity-themed fraud and targeted phishing, but the company reports no misuse so far.

Why it matters

The immediate consequence for Iris Ohyama is regulatory and reputational. Japan's Personal Information Protection Commission and the police are now in possession of the company's account of events, and the company has committed to an investigation that is still determining how many records are actually in scope. The 7.7 million figure may move.

For the people in the data, the practical risk sits in the combination of fields. Names, addresses, phone numbers, emails, and dates of birth are enough to make a convincing phishing message or a fraudulent contact, even without a password. Customers who used Iris Plaza, SIMPLE STYLE, or the Iris Tech Service sites should treat unsolicited messages that reference those details with suspicion, and should not assume that the absence of reported misuse as of November 5 means the data is inert.

For the wider industry, the shape of this disclosure is familiar: a third-party cloud service, a suspicious file, a suspension, and then a partial accounting of what was inside. Iris Ohyama's decision to take its storefront and adjacent services offline on October 28 suggests it treated the finding as serious from the start. What remains unknown — how the access happened, who did it, and whether the encrypted passwords hold up — is the part that will determine how this incident is ultimately judged.