Iris Plaza Breach May Expose Data of 7.7 Million Customers

Hackers compromised an external cloud service used by Iris Plaza, the Japanese online shopping platform operated by Iris Ohyama, potentially exposing data for about 7.7 million people. The incident was discovered on 28 October, with Iris Ohyama stating that the attackers gained access to the external service and that Iris Plaza has since been suspended, related systems disconnected, and an investigation launched.

Of the affected individuals, 5.8 million are current or former Iris Plaza members whose names, addresses, phone numbers, email addresses, dates of birth, gender information and encrypted passwords were compromised. The remaining 1.9 million are non-members who made purchases without registering; their names, addresses, phone numbers and email addresses were exposed. Iris Ohyama clarified that the hacked external cloud service does not store credit card data and that no Iris Plaza stores were affected.

In response, the company says it has blocked the attackers’ access, notified law enforcement and relevant authorities, and engaged external security experts to assist with the investigation. Iris Plaza remains offline while remediation work proceeds and the wider Iris Group businesses, including Simple Style and the home appliance subscription service, have been temporarily suspended, though Iris Ohyama states there is no evidence those sites were compromised.

The company’s incident FAQ, translated automatically, indicates there have been no reported incidents of unauthorised financial use to date. Claims are attributed to Iris Ohyama and SecurityWeek’s coverage of the incident, with ongoing investigation and official statements guiding the public understanding of the breach.