Iris Ohyama breach may expose data from 7.7 million records

Japanese household goods manufacturer Iris Ohyama says unauthorised access to an external cloud service used by its online shopping subsidiary, Iris Plaza, may have exposed personal information held in about 7.7 million records. The company said Iris Plaza found a suspicious file in the service on 28 October 2026, shut down its online shop and related systems, and confirmed that a third party had gained access. The 7.7 million figure is the total number of records stored there; the company has not confirmed that all, or any particular number, were taken.

Potentially affected records cover about 5.8 million current and former members and 1.9 million non-members. Depending on registration status, information may include names, addresses, telephone numbers, email addresses, gender, dates of birth and passwords; some information, including passwords, is encrypted. Iris Plaza said credit card details were not held in the affected cloud service and were not exposed. As of 5 November, it had received no reports of fraudulent use or financial losses linked to the incident.

The company reported the breach to Japanese police and the Personal Information Protection Commission on 29 October, blocked the access route and brought in external experts. It also suspended the SIMPLE STYLE website and some services run by group company Iris Tech Service, but said it had found no evidence those services were compromised. Iris Plaza is contacting potentially affected people and advises customers who reused their passwords elsewhere to change them. It has warned that exposed details could be used in phishing messages, calls or fake websites.