Key Takeaways
- Iris Plaza, the official online store of Iris Ohyama, said on November 5, 2026, that data on about 7.7 million people stored in an external cloud service may have been viewed or taken by an unauthorized third party.
- The 7.7 million people in the Iris Plaza breach are about 5.8 million current and former members and about 1.9 million non-members, and Iris Plaza said credit card information was not stored in the affected cloud service.
- Iris Plaza found a suspicious file in the cloud service on October 28, 2026, shut down the store and related systems, and reported the incident to police and Japan's Personal Information Protection Commission on October 29.
- Japan's government announced a 10 billion yen ($63 million) emergency cybersecurity package on November 6, 2026, after a wave of data breaches at companies and government agencies, the Associated Press reported.
What happened
Iris Plaza, the official online store of the Japanese household goods maker Iris Ohyama, said on November 5, 2026, that personal information on about 7.7 million people may have leaked after an unauthorized third party accessed an external cloud service the store used. Iris Plaza Co. is an Iris Group company based in Sendai, according to its notice (in Japanese).
Iris Plaza found a suspicious file in the cloud service on October 28, 2026, and immediately shut down the store and related systems to investigate, the company said. The investigation confirmed unauthorized access by a third party, which Iris Plaza first disclosed on October 29.
According to the November 5 notice, data stored in the cloud service may have been viewed or taken. Iris Plaza said it is still investigating how many records actually leaked and how many people were affected. Asahi Shimbun and TBS News Dig reported the same figures, and BleepingComputer reported the breach on November 8.
Who is affected
The 7.7 million figure is the total number of people whose personal information was stored in the cloud service, Iris Plaza said. It breaks down as follows:
| Group | People | Data that may have leaked |
|---|---|---|
| Members, including former members | About 5.8 million | Name, address, phone number, email address, gender, password, date of birth |
| Non-members (people who bought without registering or entered a campaign) | About 1.9 million | Name, address, phone number, email address |
Not every item was stored for every customer, the company said. Iris Plaza encrypted passwords and some other items, and it did not keep passwords for former members. The company said it did not store credit card information in the cloud service and that card data was not affected. Asahi Shimbun and TBS News Dig reported that credit card information was not involved.
Iris Plaza said it has found no unauthorized access or leak at the stores it runs on outside online marketplaces. As of November 5, the company had received no reports of misuse or financial loss tied to the incident.
Response and what is unknown
Iris Plaza reported the incident to the police and to Japan's Personal Information Protection Commission on October 29, the company said. It cut off the access route and will continue the investigation with help from outside experts. The store will stay offline until the cause is identified and steps to prevent a repeat are in place, Asahi Shimbun reported.
As a precaution, Iris Plaza also took down its home furnishings store Simple Style on October 28. Iris Tech Service, another Iris Group company, took down the sites for its home appliance subscription service and its furniture and appliance delivery and installation services the same day and stopped taking new orders. The company said it has found no unauthorized access or leak at either.
An Iris Plaza spokesperson told BleepingComputer that the company had received no direct communication from the attacker and had not identified who was responsible. Iris Plaza said it is still working to identify the cause.
What customers should do
Iris Plaza said it will contact people whose information may have leaked individually, by email and other means. It asked those customers to change their password on any other service where they use the same one.
The company warned that emails, text messages, and phone calls pretending to come from Iris Plaza or from authorities may follow, along with fake websites and social media accounts. It said it will never ask for passwords, PINs, or authentication codes, or ask customers to enter them through a link in an email or text message.
Background
The breach is one of a series that has hit Japanese companies in recent weeks. On October 28, The Record reported that Japan Airlines said a breach at one of its IT providers leaked the records of more than 90,000 customers. The Record also reported that an internet provider owned by Sony Network Communications said more than 2.5 million people had information stolen, that 11 million people had data stolen in an attack on Burger King Japan, and that 11.7 million were affected by a breach involving the gaming company Capcom.
On November 6, 2026, Japan's government announced a 10 billion yen ($63 million) emergency cybersecurity package after dozens of companies and government agencies had their systems accessed and customer data leaked, the Associated Press reported. The package includes a "top gun" team of experts that the Ministry of Economy, Trade and Industry will set up by the end of November, and a "cyber rescue team" from the public and private sectors to give first help to companies hit by attacks, according to the AP.
"At this very moment, cases of unauthorized access and data breaches are occurring, causing a major impact on daily lives of the people and corporate activities," Prime Minister Sanae Takaichi said, according to the AP.