Iris Ohyama cloud breach may affect 7.7 million people

By Daniel Okafor

Up to 7.7 million people may have had personal information exposed after a third party accessed an external cloud service used by Iris Plaza, the online shopping platform of Japanese manufacturer Iris Ohyama.

The company discovered the incident in late October 2026. It suspended Iris Plaza and related systems on October 28, then issued its first notice on October 29. The initial announcement gave limited details and described the shutdown as temporary.

What did the investigation confirm?

In a machine-translated statement, Iris Plaza said: “We immediately suspended Iris Plaza and related systems and began an investigation. We confirmed unauthorized access by a third party and disclosed it in our first notice on October 29.”

In an update earlier this week, the company said investigators had found a suspicious file within the external cloud service. Customer data held there may have been accessed by unauthorized actors. The company still cannot specify the final number of exposed records.

Accordingly, the 7.7 million figure is an upper estimate of people potentially affected, rather than a verified count of stolen records or misused accounts. Neither the cloud provider nor the intrusion method has been named. Iris Plaza also has not said how long the attacker operated.

Who sits inside the 7.7 million-person estimate?

The company divides the potential exposure into two customer populations, with up to 5.8 million registered and former members and another 1.9 million non-members.

Those upper limits total 7.7 million potential affected people, although the investigation has not confirmed that every person lost data or every record was copied. About three-quarters of the estimate consists of members or former members. Roughly one-quarter consists of non-members.

Iris Plaza serves as the online storefront for the Iris Ohyama Group, described as a major Japanese manufacturer of household products. Its catalogue ranges from storage units and LED lighting to home appliances and garden accessories.

The non-member figure widens the issue beyond registered accounts. No breakdown by country, customer segment or record type was provided for either group.

What data may have been exposed?

Iris Plaza listed seven categories of personal information that may have been exposed in the compromised external cloud service:

• Full names
• Physical addresses
• Phone numbers
• Email addresses
• Gender
• Dates of birth
• Account passwords

The mix varies by individual, and the company states that no passwords are stored for former members.

For active registered members, Iris Plaza says it stores passwords in encrypted form. It did not identify the encryption scheme, so customers cannot assess that control from the disclosure.

Credit card information was not stored in the affected cloud service, according to the company. As of November 5, the company had received no reports of misuse of the exposed information or financial loss tied to the incident.

That absence does not rule out delayed misuse or future financial loss. The seven disclosed categories also include direct contact and demographic details, which can support targeted fraud if attackers use them.

Which services did Iris Ohyama suspend?

Iris Ohyama suspended its SIMPLE STYLE online store and related systems on October 28, one day before its first public notice. The company also suspended websites for services run by Iris Tech Service Co., Ltd., including home-appliance subscriptions and furniture and appliance delivery and installation.

The suspended portfolio covers commerce, recurring subscriptions and delivery scheduling, although the company has not quantified lost sales, delayed orders or restoration dates. The first announcement described the Iris Plaza suspension as temporary. Iris Ohyama has not published a restoration timetable.

Who is responsible, and what remains undisclosed?

A company spokesperson told BleepingComputer that it had received no direct communications from the attacker and had not identified the perpetrators. BleepingComputer had asked whether a ransom payment was demanded, but the company did not resolve that question in its response.

Public disclosures still omit the suspicious file’s contents, the data-access window and whether attackers downloaded information or merely viewed it. Those omissions limit independent scrutiny of a breach with a stated ceiling of 7.7 million affected people, despite the absence of reported financial loss through November 5.

Iris Ohyama notified Japan’s Personal Information Protection Commission and police on October 29, 2026. No regulatory conclusion appears in the company’s update. No cloud product, configuration or version was named.

Until those details emerge, the 7.7 million-person estimate remains a potential exposure, not proof of 7.7 million compromised identities or confirmed fraud losses.