Iris Plaza, the online store run by Japanese home goods maker Iris Ohyama, says unauthorized access to an external cloud service may have exposed personal data. The service held about 7.7 million customer records, and the store has been offline since October 28.
The company has not yet said how many people were actually affected, so the 7.7 million figure is a ceiling on the records at risk, not a confirmed leak count.
What happened
According to the company’s second report, dated November 5, 2026, staff found suspicious files in an external cloud service on October 28. Iris Plaza shut down its site and related systems that day and started an investigation. It confirmed unauthorized access on October 29 and notified police and Japan’s Personal Information Protection Commission the same day.
As of the update, the company says the data may have been viewed or taken, but it has not confirmed an actual leak. It reports no known misuse or financial harm so far, and says the access route has been blocked. Its sister shop Simple Style and the Iris Tech Service subscription and installation services were also suspended as a precaution; the company says no unauthorized access was found there.
Who is affected
The roughly 7.7 million records break down as follows, per the company’s notice.
| Group | Records | Data stored |
|---|---|---|
| Members, including former members | About 5.8 million | Name, address, phone, email, gender, date of birth, password and other items; not every field applies to everyone |
| Non-members (guest buyers, campaign entrants) | About 1.9 million | Name, address, phone, email |
The company says some fields, including passwords, were encrypted, and that passwords of former members are not included. It has not described the encryption method. It also says credit card data was not stored in the affected service.
What to do
The company advises customers to change their password on any other service where they reused an Iris Plaza password, and to be wary of phishing by email, text, phone, fake sites and social media accounts. It says it will never ask for passwords, PINs or authentication codes by email or SMS, and it began emailing affected customers individually on November 5.
Our analysis: anyone who ever shopped at Iris Plaza should expect convincing lookalike messages that quote a real name, address or phone number. Do not click links in unexpected delivery or account notices; open the retailer’s site from a bookmark instead. Use a password manager to give every account a unique password, turn on multi-factor authentication where offered, and review card statements even though the company says card data was not involved.
What we still do not know
- How many people’s data was actually accessed or copied.
- Which cloud service was involved and how the attacker got in.
- Whether the attacker has been identified or has made any demand.
- When the Iris Plaza and Simple Style sites will reopen.
Sources: Iris Ohyama / Iris Plaza notice, second report (Nov. 5, 2026); CyberInsider (Nov. 5, 2026); SmartScope (Oct. 30, 2026).
Leave a Reply