Iris Ohyama confirms unauthorized access to an external cloud service
Japanese manufacturer Iris Ohyama disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third‑party cloud service used by its Iris Plaza online storefront. The company said it discovered the incident late last month and publicly announced the breach with limited detail, then provided an update earlier this week reporting the discovery of a suspicious file in the external cloud service.
Scale and types of data that may have been exposed
Iris Ohyama’s notice states the impact could extend to up to 5.8 million registered members and former members, and 1.9 million non‑members, for a total of roughly 7.7 million people. The company lists the following categories of information that may have been accessed:
- Full names
- Physical addresses
- Phone numbers
- Email addresses
- Gender
- Dates of birth
- Account passwords
The company says the exact mix of exposed data varies by individual—for example, former members do not have stored passwords. Iris Plaza also stated that it stores passwords for active registered members in encrypted form, but the company did not specify which encryption scheme it uses. The company further asserted that credit card information was not stored in the affected cloud service.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTimeline: discovery, suspension, and notification
According to the company’s disclosures, Iris Plaza and related systems were suspended on October 28. Iris Ohyama made its first public notification on October 29. The same day—October 29, 2026—the company notified Japan’s Personal Information Protection Commission and the police. As of November 5, Iris Plaza said it had received no reports of misuse of the exposed information or any financial loss tied to the incident.
Operational impact on SIMPLE STYLE and Iris Tech Service sites
The outage affected the Iris Plaza online store (branded SIMPLE STYLE) and related systems. Iris Ohyama said websites for Iris Tech Service Co., Ltd. services were also suspended; those services include home appliance subscriptions and furniture and appliance delivery and installation. The company’s immediate action was to suspend the affected storefront and related systems while it investigates the extent of unauthorized access to the external cloud service.
What this means for registered members, former members, and non‑members
- Registered members: Iris Ohyama holds encrypted passwords for active members and has said passwords for active members were stored in encrypted form; members should watch for unexpected account activity and follow any communications Iris Plaza issues about password resets or account remediation.
- Former members: Because former members do not have stored passwords in the affected service, their exposure differs from active members; nonetheless, the company includes former members among the up to 5.8 million impacted and they may need to monitor communications tied to the personal details listed by the company.
- Non‑members: The company reports up to 1.9 million non‑members may be included in the exposed records because the compromised cloud service contained customer data beyond registered accounts.
When contacted by BleepingComputer, an Iris Plaza spokesperson said the company had received no direct communications from the attacker and had not identified the perpetrators. The company continues to investigate and to try to determine the precise number of records exposed and the exact number of people impacted.
The record Iris Ohyama has provided is clear about what was taken and what was not: names, contact details, demographic data and, in some cases, encrypted passwords may have been accessed; credit card information was not stored in the compromised cloud service. What remains unresolved in the company’s updates is the precise count of affected records and the identity of the unauthorized actors—questions the company says it is still working to answer.
Original reporting: Iris Ohyama data cloud breach exposes info of 7.7 million customers — BleepingComputer
