# Iris Ohyama's Iris Plaza store breach may expose data on 7.7 million people · pwn.watch > Iris Plaza, which runs the official online store of Japanese manufacturer Iris Ohyama, found a suspicious file in an external cloud service it uses on Oct 28 2026, confirmed unauthorized access by a third party and took the store and related sites offline. Its Nov 5 update says the customer data kept in that cloud service may have been viewed or taken: about 5.8 million members and former members (names, addresses, phone numbers, emails, gender, encrypted passwords, birth dates and more; no passwords for former members) and about 1.9 million non-member buyers and campaign entrants (names, addresses, phone numbers, emails). Credit card data was not stored there. The actual number of people affected is still under investigation, and no misuse had been reported as of Nov 5. Page: https://pwn.watch/i/iris-ohyama-iris-plaza-cloud-breach-7-7m-nov-2026 · generated 2026-11-08T20:22:39.494Z ## Status - Severity: high · status: live · patch: partial - Product: Iris Plaza online store (Iris Ohyama Group) - Started: 2026-10-28 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/iris-ohyama-iris-plaza-cloud-breach-7-7m-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/iris-ohyama-iris-plaza-cloud-breach-7-7m-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/iris-ohyama-iris-plaza-cloud-breach-7-7m-nov-2026.json - This file: https://pwn.watch/i/iris-ohyama-iris-plaza-cloud-breach-7-7m-nov-2026/llms.txt ## Updates (newest first) - 2026-11-08: A spokesperson tells BleepingComputer the company has received no direct communication from the attacker and has not identified the perpetrators. (https://www.bleepingcomputer.com/news/security/iris-ohyama-data-cloud-breach-exposes-info-of-77-million-customers/) - 2026-11-05: Second notice: data stored in the external cloud service may have been viewed or taken, covering about 7.7 million people: about 5.8 million members and former members (name, address, phone, email, gender, encrypted password, birth date and more) and about 1.9 million non-members (name, address, phone, email). Card data was not stored there. The actual number affected is still being investigated and individual emails start going out. (https://www.irisohyama.co.jp/news/2026/?date=1105) - 2026-10-29: First notice: Iris Plaza confirms unauthorized access to its e-commerce site, keeps the site suspended and says no credit card leak has been found. It reports the incident to the police and Japan's Personal Information Protection Commission. (https://www.irisohyama.co.jp/news/2026/?date=1029) - 2026-10-28: Iris Plaza finds a suspicious file in an external cloud service it uses, immediately stops the Iris Plaza online store and related systems, and cuts off the unauthorized access route. The SIMPLE STYLE store and Iris Tech Service sites (appliance subscriptions, furniture and appliance delivery) are taken offline the same day as a precaution. (https://www.irisohyama.co.jp/news/2026/?date=1105) ## Fix brief # Security brief: Iris Ohyama's Iris Plaza store breach may expose data on 7.7 million people Source: https://pwn.watch/i/iris-ohyama-iris-plaza-cloud-breach-7-7m-nov-2026 · status: live · severity: high · updated Nov 8, 2026, 16:17 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Iris Plaza, which runs the official online store of Japanese manufacturer Iris Ohyama, found a suspicious file in an external cloud service it uses on Oct 28 2026, confirmed unauthorized access by a third party and took the store and related sites offline. Its Nov 5 update says the customer data kept in that cloud service may have been viewed or taken: about 5.8 million members and former members (names, addresses, phone numbers, emails, gender, encrypted passwords, birth dates and more; no passwords for former members) and about 1.9 million non-member buyers and campaign entrants (names, addresses, phone numbers, emails). Credit card data was not stored there. The actual number of people affected is still under investigation, and no misuse had been reported as of Nov 5. Severity detail: About 7.7 million people's contact details, including encrypted account passwords and birth dates for members; the cloud service and the access method have not been disclosed - Product: Iris Plaza online store (Iris Ohyama Group) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes There is nothing to patch. If you have or had an Iris Plaza account, change the password anywhere else you reused it. Members and non-member buyers should expect phishing, SMS and phone scams that use their name and address; Iris Plaza says it will never ask for passwords, PINs or card details by email or SMS. ## Latest updates - Nov 8, 2026: A spokesperson tells BleepingComputer the company has received no direct communication from the attacker and has not identified the perpetrators. - Nov 5, 2026: Second notice: data stored in the external cloud service may have been viewed or taken, covering about 7.7 million people: about 5.8 million members and former members (name, address, phone, email, gender, encrypted password, birth date and more) and about 1.9 million non-members (name, address, phone, email). Card data was not stored there. The actual number affected is still being investigated and individual emails start going out. - Oct 29, 2026: First notice: Iris Plaza confirms unauthorized access to its e-commerce site, keeps the site suspended and says no credit card leak has been found. It reports the incident to the police and Japan's Personal Information Protection Commission. - Oct 28, 2026: Iris Plaza finds a suspicious file in an external cloud service it uses, immediately stops the Iris Plaza online store and related systems, and cuts off the unauthorized access route. The SIMPLE STYLE store and Iris Tech Service sites (appliance subscriptions, furniture and appliance delivery) are taken offline the same day as a precaution. ## Advisories - [（第2報）株式会社アイリスプラザECサイト一時停止のお知らせ 外部クラウドサービスへの不正アクセスによる個人情報漏えいのおそれに関するお詫び](https://www.irisohyama.co.jp/news/2026/?date=1105) (Iris Plaza (Iris Ohyama Group)) - [株式会社アイリスプラザECサイト一時停止のお知らせ](https://www.irisohyama.co.jp/news/2026/?date=1029) (Iris Plaza (Iris Ohyama Group)) ## Write-ups & news - [アイリスオーヤマ、最大770万人分漏洩か　「アイリスプラザ」顧客情報](https://www.nikkei.com/article/DGXZQOCC05B230V01C26A1000000/) - [アイリスオーヤマ、非会員含む約770万人分の情報漏えいか　外部クラウドに不審ファイル発見→不正アクセス発覚](https://www.itmedia.co.jp/news/article/2611/06/2000002934/) - [Iris Ohyama data cloud breach exposes info of 7.7 million customers](https://www.bleepingcomputer.com/news/security/iris-ohyama-data-cloud-breach-exposes-info-of-77-million-customers/) ## Caveats Iris Plaza has not named the external cloud service or said how the attacker got in, and it has not said which scheme protects the stored passwords. Its stores on outside marketplaces (Rakuten, Yahoo! and au PAY Market) are not affected according to the company. The Iris Plaza site stays down until the cause is found and fixes are in place. --- Machine-readable: https://pwn.watch/i/iris-ohyama-iris-plaza-cloud-breach-7-7m-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.