By Hamza Faisal
Japanese manufacturer Iris Ohyama has disclosed that a breach of a third-party cloud service may have exposed the personal information of up to 7.7 million customers of its Iris Plaza online shopping platform, in one of Japan's largest consumer data incidents of the year.
The company said it found a suspicious file in an external cloud service used by the online store on October 28, and immediately suspended Iris Plaza and related systems while it investigated. The inquiry confirmed that an outside party had gained unauthorized access, and the company issued its first public notice on October 29.
Iris Ohyama estimates that as many as 5.8 million registered and former members could be affected, along with 1.9 million non-members who shopped as guests or took part in campaigns. The company stressed that the investigation has not yet established exactly how many records were actually accessed, so the figure is a maximum exposure, not a confirmed leak.
Passwords and personal details among the data at risk
For registered members, the data held in the compromised cloud environment included names, addresses, telephone numbers, email addresses, gender, passwords and dates of birth. For non-members, the exposed fields were limited to names, addresses, telephone numbers and email addresses.
One piece of reassurance for customers is that credit card information was not stored in the affected cloud service, and the company says payment details were not impacted. As of its November 5 update, Iris Ohyama said it had received no reports of the exposed information being misused and no reports of financial losses tied to the incident.
The company began notifying affected customers on November 5, with individual emails and other communications to follow as the investigation continues. It also reported the incident to Japan's Personal Information Protection Commission and to police on October 29.
A warning about third-party cloud risk
Iris Plaza is the official online store of the Iris Ohyama Group, a Sendai-based maker of household goods ranging from storage units and LED lighting to home appliances and garden accessories. The breach did not strike the company's own servers, but a cloud service run by an outside provider that Iris Plaza relied on to store customer data.
That detail is what makes the incident notable beyond its size. Companies increasingly hand customer records to specialist cloud vendors, and a single weak link in that chain can put millions of shoppers at risk even when the retailer's own systems are untouched. Security specialists say the case underlines why businesses need to audit the access controls of every outside service that touches customer data, not just their own networks.
Iris Ohyama says it has blocked the unauthorized access route and is continuing to examine the compromised environment to determine the full extent of the exposure. Customers who used Iris Plaza are advised to change their passwords and watch for phishing messages that could exploit the leaked contact details.
What customers should do now
Anyone who held an Iris Plaza account should change that password, and change it anywhere else the same password was reused. Customers should also be wary of unexpected emails or calls claiming to be from Iris Plaza, since the exposed names, phone numbers and email addresses give attackers the raw material for convincing phishing attempts.
The company has not said when Iris Plaza will reopen, and the investigation is ongoing. Further updates are expected as it confirms how many of the 7.7 million potentially affected records were actually reached by the intruders.
