{"id":"CMP-202611-vh4chj","kind":"campaign","aliases":[],"related":[],"title":"Japanese online store Iris Plaza (Iris Ohyama) breached through a third-party cloud service: names, addresses, phone numbers, emails, birth dates and encrypted passwords of up to 7.7 million people may be exposed","description":null,"summary":"Iris Ohyama, the Japanese manufacturer that runs the Iris Plaza online store, says an unauthorized party got into an external cloud service the store used. Customer data stored there may have been accessed. The company found the access in late October 2026, took Iris Plaza and related systems offline on 28 Oct, and disclosed it on 29 Oct. It reported the incident to Japan's Personal Information Protection Commission and the police the same day. Up to 7.7 million people may be affected: about 5.8 million current and former members and 1.9 million non-member buyers. The exact count is still being worked out. Exposed data may include full name, postal address, phone number, email address, gender, date of birth and, for current members, account passwords. Passwords were stored encrypted, but the scheme is not stated. Former members had no password stored. Card data was not in the affected service. The cloud provider, the attacker, how they got in and whether a ransom was demanded are all unknown. As of 5 Nov there were no reports of misuse.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Iris Plaza","note":"customer, former-member and non-member buyer data in a third-party cloud service, found late Oct 2026","fixed":[],"ecosystem":"saas"},{"name":"Iris Ohyama","note":"disclosed by the company","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Did you, or your business, buy from or have an account on Iris Plaza (Iris Ohyama's online store), as a member, former member or guest buyer? If so, assume your name, address, phone, email, gender and birth date may be exposed.\n- Be suspicious of emails, texts or calls claiming to be from Iris Ohyama or Iris Plaza about this breach, refunds, compensation or a password reset, especially ones that use your real name and address. The source names no specific phishing lure, sender or domain (unknown).\n- No technical indicators (IPs, domains, hashes) have been published.","fix":"- If you reused your Iris Plaza password anywhere else, change it on those sites now, and change it on Iris Plaza once the store is back.\n- Turn on two-factor sign-in where you can, starting with email and shopping accounts that used the same password.\n- Do not click links or call numbers in unexpected messages about the breach. Go to Iris Ohyama's official website for notices.\n- Card data was not stored in the affected service, but keep an eye on statements anyway.","status":"open","published_at":null,"first_seen_at":"2026-11-08T16:21:41+00:00","triaged_at":"2026-11-08T16:21:41+00:00","updated_at":"2026-11-08T16:32:11+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-08T16:37:17Z","path":"third-party-breach","entry":"unknown","reason":"The record says an unauthorized party got into an external cloud service the store used and that customer data stored there may have been accessed, but it states that how the attacker got in is unknown.","history":[{"at":"2026-11-08T16:26:58Z","path":"third-party-breach","entry":"unknown","confidence":0.85}],"confidence":0.85}},"analyst_status":"done","analyst_note":null,"search":"'-202611':36A '1.9':137B '2026':87B '28':96B '29':102B '5':217B '5.8':130B '7.7':29A,123B 'access':78B,83B 'account':171B 'address':17A,158B,162B 'affect':128B,195B 'attack':201B 'birth':21A,166B 'breach':8A 'buyer':142B 'campaign':42B 'card':189B 'cloud':14A,66B,198B 'cmp':35A 'commiss':114B 'compani':80B 'count':145B 'current':132B,169B 'custom':71B 'data':72B,152B,190B 'date':22A,164B 'day':120B 'demand':211B 'disclos':99B 'earli':44B 'early-warn':43B 'email':20A,161B 'encrypt':24A,176B 'exact':144B 'expos':34A,151B 'extern':65B 'former':134B,183B 'found':81B 'full':155B 'gender':163B 'got':62B,204B 'incid':107B 'includ':154B 'inform':112B 'iri':4A,6A,46B,54B,89B 'iris':38A,40A 'japan':109B 'japanes':1A,49B 'late':85B 'manufactur':50B 'may':32A,75B,126B,153B 'member':135B,141B,170B,184B 'million':30A,124B,131B,138B 'misus':224B 'name':16A,156B 'non':140B 'non-memb':139B 'nov':218B 'number':19A,160B 'oct':97B,103B 'octob':86B 'offlin':94B 'ohyama':7A,41A,47B 'onlin':2A,56B 'parti':13A,61B 'password':25A,172B,173B,187B 'peopl':31A,125B 'person':111B 'phone':18A,159B 'plaza':5A,39A,55B,90B 'polic':117B 'postal':157B 'protect':113B 'provid':199B 'ransom':209B 'relat':92B 'report':105B,222B 'run':52B 'say':58B 'scheme':179B 'servic':15A,67B,196B 'state':182B 'still':147B 'store':3A,57B,69B,73B,175B,188B 'system':93B 'third':12A 'third-parti':11A 'took':88B 'unauthor':60B 'unknown':214B 'use':70B 'vh4chj':37A 'warn':45B 'whether':207B 'work':149B","nicknames":["Iris Plaza breach"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["irisohyama","irisplaza","irisplazabreach","ohyama","plaza"],"ptokens":["iris","ohyama","plaza"],"labels":["campaign","earlywarning","medium","other","vendor"],"campaign_type":"breach","search_a":"'-202611':36A '7.7':29A 'address':17A 'birth':21A 'breach':8A 'cloud':14A 'cmp':35A 'date':22A 'email':20A 'encrypt':24A 'expos':34A 'iri':4A,6A 'iris':38A,40A 'japanes':1A 'may':32A 'million':30A 'name':16A 'number':19A 'ohyama':7A,41A 'onlin':2A 'parti':13A 'password':25A 'peopl':31A 'phone':18A 'plaza':5A,39A 'servic':15A 'store':3A 'third':12A 'third-parti':11A 'vh4chj':37A","search_b":"'1.9':137B '2026':87B '28':96B '29':102B '5':217B '5.8':130B '7.7':123B 'access':78B,83B 'account':171B 'address':158B,162B 'affect':128B,195B 'attack':201B 'birth':166B 'buyer':142B 'campaign':42B 'card':189B 'cloud':66B,198B 'commiss':114B 'compani':80B 'count':145B 'current':132B,169B 'custom':71B 'data':72B,152B,190B 'date':164B 'day':120B 'demand':211B 'disclos':99B 'earli':44B 'early-warn':43B 'email':161B 'encrypt':176B 'exact':144B 'expos':151B 'extern':65B 'former':134B,183B 'found':81B 'full':155B 'gender':163B 'got':62B,204B 'incid':107B 'includ':154B 'inform':112B 'iri':46B,54B,89B 'japan':109B 'japanes':49B 'late':85B 'manufactur':50B 'may':75B,126B,153B 'member':135B,141B,170B,184B 'million':124B,131B,138B 'misus':224B 'name':156B 'non':140B 'non-memb':139B 'nov':218B 'number':160B 'oct':97B,103B 'octob':86B 'offlin':94B 'ohyama':47B 'onlin':56B 'parti':61B 'password':172B,173B,187B 'peopl':125B 'person':111B 'phone':159B 'plaza':55B,90B 'polic':117B 'postal':157B 'protect':113B 'provid':199B 'ransom':209B 'relat':92B 'report':105B,222B 'run':52B 'say':58B 'scheme':179B 'servic':67B,196B 'state':182B 'still':147B 'store':57B,69B,73B,175B,188B 'system':93B 'took':88B 'unauthor':60B 'unknown':214B 'use':70B 'warn':45B 'whether':207B 'work':149B","search_c":"","cause_entry":"unknown","cause_path":"third-party-breach","disclosures_checked_at":"2026-11-08T16:32:24+00:00","first_public_at":"2026-11-08T15:43:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-vh4chj","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-08T16:21:41+00:00","fetched_at":"2026-11-08T16:21:41+00:00","note":null}],"documents":[{"id":102313,"url":"https://www.bleepingcomputer.com/news/security/iris-ohyama-data-cloud-breach-exposes-info-of-77-million-customers/","title":"BleepingComputer: Iris Ohyama data cloud breach exposes info of 7.7 million customers","kind":"blog","source":"blog","publisher":null,"text":"Iris Ohyama data cloud breach exposes info of 7.7 million customers\n\nJapanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used. [...]","published_at":"2026-11-08T15:43:08+00:00","relation":"describes","confidence":null,"note":null},{"id":102296,"url":"https://x.com/BleepinComputer/status/2119455747553550769","title":"@BleepinComputer: Iris Ohyama data cloud breach exposes info of 7.7 million customers\nhttps://t.co","kind":"post","source":"x","publisher":null,"text":"Iris Ohyama data cloud breach exposes info of 7.7 million customers\nhttps://t.co/WjDa0CY5sv\n\nhttps://t.co/WjDa0CY5sv\n\nlikes 11 reposts 3","published_at":"2026-11-08T15:43:22+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[{"company":"Iris Ohyama","domain":"irisohyama.co.jp","url":"https://www.irisohyama.co.jp/news/2026/?date=1105","kind":"blog","published_at":"2026-11-05T00:00:00+00:00","quote":"アイリスグループの株式会社アイリスプラザ（本社：宮城県仙台市、取締役社長：岩﨑 亮太、以下、当社）が運営するアイリスオーヤマ公式通販サイト「アイリスプラザ」（以下、「アイリスプラザ」）において発生した不正アクセス事案について、調査を進めた結果、個人情報の一部が漏えいした可能性があることが判明いたしました。","confidence":0.8999999761581421,"source":"model","created_at":"2026-11-08T16:32:11+00:00","entry":"unknown"},{"company":"Iris Ohyama","domain":"irisohyama.co.jp","url":"https://www.irisohyama.co.jp/news/2026/?date=1029","kind":"blog","published_at":"2026-10-29T00:00:00+00:00","quote":"このたび、株式会社アイリスプラザが運営するECサイトにおいて不正アクセスを確認いたしました。","confidence":0.800000011920929,"source":"model","created_at":"2026-11-08T16:32:16+00:00","entry":"unknown"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}