Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

Iris Plaza cloud breach may expose data of 7.7 million people

4 sources · 4 articlesFirst reported Updated ()
What's new

November 10: Security Affairs says the 7.7 million figure is stored records, not confirmed theft, and warns of follow-up phishing after the October 28 file find.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Iris Plaza remains offline after a third-party cloud breach that may have exposed personal data of up to 7.7 million people.

Japanese retailer Iris Ohyama says attackers may have accessed a third-party cloud service used by its Iris Plaza shopping site, potentially exposing data on about 7.7 million people. Of those, 5.8 million are current or former members whose records may include names, addresses, phone numbers, emails, gender, dates of birth and encrypted passwords; 1.9 million non-members may have had names, addresses, phones and emails exposed. Credit card data was not stored in the service. SecurityWeek and Security Affairs date discovery of a suspicious file to October 28; The Register says unauthorized access was discovered on October 29. The company shut the platform, notified police and Japan’s Personal Information Protection Commission, and as of November 5 reported no confirmed fraud or financial loss.

Key facts
  • 5.8 million members and 1.9 million non-members may be affected.
  • Member passwords were stored encrypted; card data was not in the cloud store.
  • Iris Plaza remains offline, with no reopening date given.
  • Related group sites were suspended; the company found no evidence they were compromised.
  • Customers who reused Iris Plaza passwords elsewhere were told to change them.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026Iris Plaza finds a suspicious file and suspends the site. · Security Affairs
  2. Oct 29, 2026Company notifies police and Japan’s privacy commission. · Security Affairs
  3. Nov 5, 2026Company reports no confirmed fraud or financial loss. · BleepingComputer

What each outlet adds

beyond the shared facts
  • Security Affairs7.7 million is stored records, not confirmed stolen; phishing warning.
  • The RegisterDates discovery to October 29; no reopening date.
  • SecurityWeekAdditional sites suspended with no evidence of compromise.
  • BleepingComputerPasswords encrypted for active members; authorities notified.
Vendors
Iris Ohyama
Products
Iris Plaza
Victims
customersIris OhyamaIris Plaza
Organizations
Personal Information Protection Commission
Countries
Japan

Coverage

oldest first · one row per article · UTC
  1. · 3d ago BleepingComputerFirst report

    Iris Ohyama data cloud breach exposes 7.7 million customers

    7.7 million Iris Ohyama customers may have had personal data exposed in cloud service breach.

  2. · 2d ago SecurityWeek

    Iris Plaza breach may have exposed data of 7.7M customers

    Hackers may have stolen the personal information of 7.7 million people from Japanese online shopping platform Iris Plaza.

  3. · 2d ago The Register · Security

    Iris Ohyama pulls online store after cloud breach risks 7.7M records

    The company exposed personal data of 7.7 million customers, including passwords for some.

  4. · 1d ago Security Affairs

    Iris Plaza cloud breach may expose data of 7.7 million people

    About 5.8 million members and 1.9 million non-members may be affected; card data was not in the cloud store.