About 7.7 million people may have had personal information exposed in a cloud intrusion affecting Iris Ohyama’s Iris Plaza shopping platform, BleepingComputer reported on November 8. The Japanese manufacturer confirmed unauthorized access to an outside cloud service and suspended shopping and related systems during its investigation.
The potential exposure reaches beyond current account holders. Iris Ohyama’s assessment covers up to 5.8 million current and former registered members, along with 1.9 million non-members, while investigators continue to establish how many people and records were affected.
Iris Plaza sells products from the Iris Ohyama Group, whose household goods range from storage units and LED lighting to appliances and garden accessories.
Personal details and passwords potentially involved
The company’s notification identifies seven categories of information that may have been exposed: full names, postal addresses, telephone numbers, email addresses, gender, birth dates and account passwords. Which details were involved depends on the individual; former members, for example, have no passwords stored.
For active registered members, Iris Plaza said it keeps passwords encrypted, but it did not identify the encryption method. The company said the affected cloud service held no credit card information.
By November 5, Iris Plaza had received no reports linking the incident to misuse of personal information or financial loss.
Suspicious file led to investigation and shutdowns
Iris Ohyama discovered the incident in late October. In an update earlier in the week of BleepingComputer’s report, the company described finding a suspicious file in the external cloud service supporting Iris Plaza. It said it immediately stopped the platform and related systems and opened an investigation, which confirmed that an unauthorized third party had gained access. Customer information in that service may also have been accessed.
The disruption extended to several services. On October 28, the company suspended its SIMPLE STYLE online store and related systems. Websites serving Iris Tech Service Co., Ltd. were also suspended, including those for home appliance subscriptions and furniture and appliance delivery and installation.
The company issued its first public notice about the unauthorized access on October 29, 2026, and notified Japan’s Personal Information Protection Commission and police that day.
When BleepingComputer asked Iris Plaza for further details, including whether a ransom had been demanded, a spokesperson said the company had received no direct communication from the attacker and had yet to identify those responsible.
