Overview
Iris Plaza, the Japanese online shopping platform run by household products and appliance maker Iris Ohyama, says hackers compromised an external cloud service it uses and may have stolen customer personal information. Up to 7.7 million people may be affected.
Timeline
- October 28 — the breach was discovered
- November 5 — the company published its disclosure
Who Is Affected
| Group | Count | Data potentially exposed |
|---|---|---|
| Current and former members | 5.8 million | Names, addresses, phone numbers, email addresses, dates of birth, gender, and encrypted passwords |
| Non-members (guest purchasers) | 1.9 million | Names, addresses, phone numbers, and email addresses |
The company says the affected cloud service does not store credit card information. It has not named the cloud provider or the attackers.
Response
Iris Ohyama suspended Iris Plaza and disconnected related systems, blocked the attackers' access to the service, notified law enforcement and authorities, and hired external experts. The platform remains offline during remediation. Related services, including the Simple Style home appliance subscription and delivery/installation offerings, and new site applications, were also suspended as a precaution, though the company has no evidence they were compromised. It reports no unauthorized use or financial damage so far, and no physical Iris Plaza stores were affected.
Why It Matters
The incident is another example of risk concentrated in third-party cloud services: the platform's own systems may be sound, yet customer data held with a provider can still be exposed. Because encrypted passwords were included, members who reused passwords elsewhere should take precautions.
Recommendations
- Change your Iris Plaza password, and any site where you reused it, once the service returns.
- Expect phishing that uses leaked names, addresses, and phone numbers.
- Organizations should inventory external cloud services holding customer data and enforce MFA, scoped credentials, and logging on them.