Iris Plaza, the online shop run for Japanese household-goods maker Iris Ohyama, found a suspicious file in an outside cloud service on Oct. 28 and shut down its systems the same day. A second notice dated Nov. 5 says personal data on about 7.7 million records held in that service may have leaked. The company has not yet said how many people were actually affected.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The figure is a ceiling drawn from what the cloud service stored, not a count of confirmed victims. Iris Plaza says the data may have been viewed or taken by an unauthorized third party, that some fields are encrypted, and that no fraud or financial harm tied to the incident had been reported when the notice went out.
The 7.7 million split: members and shoppers who never registered
The Nov. 5 notice posted on Iris Ohyama’s news page breaks the total into two groups. About 5.8 million records belong to members, a count that includes people who have since withdrawn. Roughly 1.9 million belong to non-members, such as customers who bought without an account or entered a campaign.
Member records may include name, address, phone number, email, gender, password and date of birth, with passwords excluded for withdrawn members. Non-member records hold name, address, phone number and email only. The company adds that not every field was exposed for every person, and that credit card data was never stored in the affected cloud service. Because gender and date of birth sit among the member fields, a full member record is the kind of data that supports convincing impersonation even without a card number.
CyberInsider’s summary notes that the company has not said which encryption methods protect the passwords and other encrypted fields, a detail that decides how risky a leaked password record would be. Japanese outlet SBbit’s report on the second notice quotes the company as saying up to about 7.7 million people’s data may have leaked, and also that the actual number of leaked records is still under investigation.
Timeline from the Oct. 28 shutdown to customer emails
According to the notice, Iris Plaza reported the incident to the police and to Japan’s Personal Information Protection Commission on Oct. 29, the same day it issued its first public report. SmartScope’s Oct. 30 write-up shows how little was known then: no number of affected people, no data types, no origin of the access and no start date, only a suspension of the official store and a warning about phishing. SBbit’s account of the second notice also records that other group sites were halted from Oct. 28.
By Nov. 5 the company had blocked the access route, finished what it calls initial containment, brought in outside experts and begun emailing potentially affected customers one by one. It says it found no unauthorized access at its stores on external marketplaces.
Which Iris services are offline
The Iris Plaza site remains closed, and the company will announce a restart only after the cause is identified and prevention measures are in place. The SIMPLE STYLE home-fashion site has been offline since Oct. 28 as a precaution. Iris Techservice’s appliance subscription and delivery and installation services also went offline that day, and new sign-ups are suspended. The notice says unauthorized access has not been confirmed at either of those. Credit card data was not in the cloud service, which narrows one common fallout from retailer breaches, but contact details paired with birth dates and, for members, password data are what phishing and credential-stuffing campaigns use. The password-reuse advice exists for that reason.
Coverage of the breach in English began with BleepingComputer’s report on the cloud breach, which attributes the intrusion to unauthorized access to a third-party cloud service used for the Iris Plaza platform. That page could not be loaded during research, so the details above rest on the company’s own notice and the Japanese and security-site summaries of it.
Guidance the company gave customers
Iris Plaza tells customers to change the password on any other service where the same one was used, and to be wary of phishing emails, text messages, calls and fake sites or social media accounts posing as the company or authorities. It says it will never ask for passwords, PINs or authentication codes through links in email or text messages, and it set up a weekday help line, a 24-hour support chatbot and an email address for questions. The phone line, 0120-108-824, runs weekdays and Saturdays from 9:30 a.m. to 5 p.m. Japan time.
The open question is the one the notice itself leaves open: how many of the 7.7 million records were actually viewed or copied, and which fields were readable. Iris Plaza says the investigation with outside experts and the authorities is continuing. The company said no misuse had been reported as of Nov. 5, a statement that covers only what it had received by then.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- The FAA wants $2.39 million from a flight school it says flew a Cessna about 280 times with an unapproved part
- Shaq spent $1.3 million on three Rolls-Royce Phantoms to prove a point to a salesman
- Over 20 trillion gallons of rain fell on the Four Corners states and Nevada in two weeks
- A handful of car transmissions are so tough that mechanics say they almost never die
