Japanese manufacturing firm Iris Ohyama has confirmed a significant data security incident involving its online shopping platform, Iris Plaza. The breach, which was publicly disclosed on October 29, 2026, resulted from unauthorized access to a third-party cloud service utilized by the company to store customer information. The firm estimates that the personal details of approximately 7.7 million individuals may have been compromised during the intrusion.
The affected population includes 5.8 million current and former registered members, alongside 1.9 million non-members who interacted with the platform. Upon discovering a suspicious file within the external cloud environment late last month, Iris Ohyama initiated an immediate investigation and suspended the Iris Plaza website and its related systems. The company also shuttered the web portals for Iris Tech Service Co., Ltd., which manages home appliance subscriptions and furniture delivery services, as a precautionary measure.
According to the company, the exposed data varies depending on the individual's history with the platform. The categories of compromised information include full names, physical addresses, telephone numbers, email addresses, genders, and dates of birth. For active registered members, account passwords were also stored in the affected cloud environment. Iris Ohyama stated that these passwords were held in an encrypted format, though the specific cryptographic methods employed have not been disclosed. Former members, however, do not have passwords stored in the system.
Iris Ohyama has explicitly confirmed that credit card information was not stored within the compromised cloud service, mitigating concerns regarding direct financial theft through payment card data. As of November 5, 2026, the company reported that it had received no evidence of the stolen information being misused or any reports of financial losses linked to the breach.
The company has maintained that it has not identified the perpetrators behind the unauthorized access. Furthermore, Iris Ohyama representatives have stated that they have received no direct communications from any threat actors, suggesting that no ransom demands have been made at this stage of the investigation.
In alignment with regulatory requirements, the company notified the Japanese Personal Information Protection Commission and local law enforcement on October 29, 2026. The investigation into the full scope of the incident remains ongoing as the company works to determine the precise extent of the data access and the specific impact on each affected user.
The breach at Iris Plaza is part of a broader trend of large-scale data exposures affecting Japanese entities. The company continues to manage the fallout of the incident while keeping its online storefronts and related digital services offline to prevent further unauthorized activity. Customers are advised to remain vigilant against potential phishing attempts or unsolicited communications that may leverage the exposed personal data.
