Japanese online store Iris Plaza (Iris Ohyama) breached through a third-party cloud service: names, addresses, phone numbers, emails, birth dates and encrypted passwords of up to 7.7 million people may be exposed

Iris Ohyama, the Japanese manufacturer that runs the Iris Plaza online store, says an unauthorized party got into an external cloud service the store used. Customer data stored there may have been accessed. The company found the access in late October 2026, took Iris Plaza and related systems offline on 28 Oct, and disclosed it on 29 Oct. It reported the incident to Japan's Personal Information Protection Commission and the police the same day. Up to 7.7 million people may be affected: about 5.8 million current and former members and 1.9 million non-member buyers. The exact count is still being worked out. Exposed data may include full name, postal address, phone number, email address, gender, date of birth and, for current members, account passwords. Passwords were stored encrypted, but the scheme is not stated. Former members had no password stored. Card data was not in the affected service. The cloud provider, the attacker, how they got in and whether a ransom was demanded are all unknown. As of 5 Nov there were no reports of misuse.