What happened
- Japanese manufacturer Iris Ohyama, operator of the Iris Plaza online store, said personal data of about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service. BleepingComputer published it on November 8, 2026.
- The company detected the incident in late October and disclosed it with few details on October 29. It said it immediately suspended Iris Plaza and related systems.
- In an update this week it specified that it found a suspicious file in the external service and confirmed access by an unauthorized third party.
- The figures include up to 5.8 million registered members and former members, and 1.9 million people who were not members.
Why it matters
The problem was not in the company’s own servers but in an outside provider that held its data. It is the same pattern as other recent cases: the weak link is a third party with access to information on many people.
For those who bought at Iris Plaza, the company says the types of data exposed vary by person and that credit cards were not stored in that service. It also says passwords of active members were stored encrypted, without specifying the method, and that former members’ passwords were not stored.
The number
7.7 million people, 0 reports of misuse. As of November 5, Iris Plaza had received no reports of misuse of the information or financial loss tied to the incident. The company is still determining how many records and how many people were affected.
Context
Iris Plaza is the online store of the Iris Ohyama group, a Japanese manufacturer of household products from storage units and LED lighting to appliances and garden accessories. The SIMPLE STYLE store and related systems were suspended on October 28, and the same applies to the websites of Iris Tech Service services, including appliance repair.
BleepingComputer quotes machine translations of the Japanese statement, so nuances of the original wording may differ. The company has not said which cloud provider was affected.
At Mamífero we cover cases with that trait. Crédit Mutuel Arkéa suffered a fraud of up to $133 million through a provider, Chainalysis admitted a breach exposed credentials of all its users, a wave of cyberattacks hit South Korean financial firms and Firefox, Chrome and Apple blocked eMudhra certificates.
What’s next
- The company must finish counting exposed records and affected people.
- It remains unknown when the store and service sites will reopen.
- Users with an Iris Plaza account would do well to change the password if they reused it elsewhere.
Bottom line
The leak shows how far an incident at a provider can reach: it affected millions of people without touching the company’s core systems. The practical lesson is to review which data are entrusted to third parties and with what controls.
Sources
- BleepingComputer, “Iris Ohyama data cloud breach exposes info of 7.7 million customers”, November 8, 2026, link. The company’s original statement is in Japanese and could not be read; the outlet’s translated quotes are used.
- Cover image: jaydeep_, CC0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
