--- id: "CMP-202611-vh4chj" page: "https://infrastack.ai/live/CMP-202611-vh4chj" kind: "campaign" aliases: [] title: "Japanese online store Iris Plaza (Iris Ohyama) breached through a third-party cloud service: names, addresses, phone numbers, emails, birth dates and encrypted passwords of up to 7.7 million people may be exposed" severity: "medium" cvss: null epss: null exploited: false status: "open" category: "other" products: [{"name": "Iris Plaza", "note": "customer, former-member and non-member buyer data in a third-party cloud service, found late Oct 2026", "fixed": [], "ecosystem": "saas"}, {"name": "Iris Ohyama", "note": "disclosed by the company", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-08T16:21:41+00:00" updated_at: "2026-11-08T16:32:11+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-08T16:21:41+00:00"}] exploit_sources: [] --- # Japanese online store Iris Plaza (Iris Ohyama) breached through a third-party cloud service: names, addresses, phone numbers, emails, birth dates and encrypted passwords of up to 7.7 million people may be exposed Link for people: https://infrastack.ai/live/CMP-202611-vh4chj (this .md is for agents) Iris Ohyama, the Japanese manufacturer that runs the Iris Plaza online store, says an unauthorized party got into an external cloud service the store used. Customer data stored there may have been accessed. The company found the access in late October 2026, took Iris Plaza and related systems offline on 28 Oct, and disclosed it on 29 Oct. It reported the incident to Japan's Personal Information Protection Commission and the police the same day. Up to 7.7 million people may be affected: about 5.8 million current and former members and 1.9 million non-member buyers. The exact count is still being worked out. Exposed data may include full name, postal address, phone number, email address, gender, date of birth and, for current members, account passwords. Passwords were stored encrypted, but the scheme is not stated. Former members had no password stored. Card data was not in the affected service. The cloud provider, the attacker, how they got in and whether a ransom was demanded are all unknown. As of 5 Nov there were no reports of misuse. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - saas:Iris Plaza affected range not listed fixed no fixed version listed - vendor:Iris Ohyama affected range not listed fixed no fixed version listed ## Cause How the attacker got in: not disclosed yet (unknown). The record says an unauthorized party got into an external cloud service the store used and that customer data stored there may have been accessed, but it states that how the attacker got in is unknown. How it reached others: customers' data or keys went with it (third-party-breach). Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#third-party-breach ## How to check - Did you, or your business, buy from or have an account on Iris Plaza (Iris Ohyama's online store), as a member, former member or guest buyer? If so, assume your name, address, phone, email, gender and birth date may be exposed. - Be suspicious of emails, texts or calls claiming to be from Iris Ohyama or Iris Plaza about this breach, refunds, compensation or a password reset, especially ones that use your real name and address. The source names no specific phishing lure, sender or domain (unknown). - No technical indicators (IPs, domains, hashes) have been published. ## Fix - If you reused your Iris Plaza password anywhere else, change it on those sites now, and change it on Iris Plaza once the store is back. - Turn on two-factor sign-in where you can, starting with email and shopping accounts that used the same password. - Do not click links or call numbers in unexpected messages about the breach. Go to Iris Ohyama's official website for notices. - Card data was not stored in the affected service, but keep an eye on statements anyway. ## Timeline - 2026-10-29T00:00:00+00:00 confirmed by Iris Ohyama (blog) https://www.irisohyama.co.jp/news/2026/?date=1029 "このたび、株式会社アイリスプラザが運営するECサイトにおいて不正アクセスを確認いたしました。" - 2026-11-05T00:00:00+00:00 confirmed by Iris Ohyama (blog) https://www.irisohyama.co.jp/news/2026/?date=1105 "アイリスグループの株式会社アイリスプラザ（本社：宮城県仙台市、取締役社長：岩﨑 亮太、以下、当社）が運営するアイリスオーヤマ公式通販サイト「アイリスプラザ」（以下、「アイリスプラザ」）において発生した不正アクセス事案について、調査を進めた結果、個人情報の一部が漏えいした可能性があることが判明いたしました。" - 2026-11-08T16:21:41+00:00 analyst ## Documents - [describes] BleepingComputer: Iris Ohyama data cloud breach exposes info of 7.7 million customers https://www.bleepingcomputer.com/news/security/iris-ohyama-data-cloud-breach-exposes-info-of-77-million-customers/ - [describes] @BleepinComputer: Iris Ohyama data cloud breach exposes info of 7.7 million customers https://t.co https://x.com/BleepinComputer/status/2119455747553550769 --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_