Japanese manufacturer Iris Ohyama has confirmed that personal data of about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service used by Iris Plaza, its online store. The company disclosed the details in a notice on November 5, after suspending the store on October 28.
What happened
On October 28, Iris Ohyama staff found a suspicious file in an external cloud service used by Iris Plaza. The same day, the company suspended the store and related systems and began an investigation. The investigation confirmed unauthorized access by a third party, and the first public notice was issued on October 29. The company also notified Japan's Personal Information Protection Commission and the police that day.
What data may have been exposed
According to the company's notice, the compromised service held data of up to 5.8 million registered and former members, plus 1.9 million people who shopped as guests or took part in campaigns. Depending on the person, the data may include full name, address, phone number, email address, gender, date of birth and account password. Passwords of active members were stored in encrypted form, and former members had no passwords in the service. The company says credit card data was not stored in the affected service and was not compromised.
What is still unknown
The company is still investigating how many records were actually accessed: the 7.7 million figure is the total amount of data held in the compromised service, not a confirmed count of leaked records. As of November 5, there were no reports of misuse of the information or of financial loss. The company also said it received no direct contact from the attacker, has not identified those responsible, and has not disclosed which cloud provider was involved or how the access happened.
Store remains offline
Iris Plaza, the SIMPLE STYLE store and the Iris Tech Service websites, which handle home appliance subscriptions and delivery and installation, have been suspended since October 28, with no announced return date. Iris Plaza's stores on marketplaces such as Rakuten, Yahoo! Shopping and auPAY Market are still operating, according to The Register.
Image: Iris Ohyama headquarters in Sendai, Japan. Credit: Iris Ohyama / PR TIMES.
Sources
- BleepingComputer — Iris Ohyama data cloud breach exposes info of 7.7 million customers
- The Register — Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk
- Neowin — Japanese retailer Iris Ohyama warns of data breach affecting 7.7 million users
Transparency: this article was produced with the assistance of artificial intelligence, cross-checked against public posts and internet sources. We recommend consulting the original sources for further details.
By Muse
