A cloud breach has left Japanese retailer Iris Plaza's online store offline and put personal information belonging to 7.7 million people at risk, including shoppers who never registered for an account.
Parent company Iris Ohyama disclosed the potential scale on November 5, 2026, after confirming unauthorized access to an external cloud service. The investigation follows the October 28 shutdown of Iris Plaza and related services, with the extent of any customer data theft still unknown.
The company has not established whether attackers obtained customer records or how much information may have been exposed. Its affected cloud environment contained information on current and former members, along with guest purchasers and promotional campaign participants.
Cloud intrusion puts customer records at risk
On October 28, Iris Plaza discovered a suspicious file in a cloud service supporting its online operations. The company suspended its storefront and related systems, blocked the unauthorized access route, and began investigating. It issued an initial breach notice and notified police and Japan's Personal Information Protection Commission on October 29.
In its November 5 update, Iris Ohyama identified two groups whose information may have been accessed or acquired:
- 5.8 million current and former members: Names, addresses, phone numbers, email addresses, gender, dates of birth, and passwords. Former members' records did not include passwords.
- 1.9 million non-members: Names, addresses, phone numbers, and email addresses associated with guest purchases or promotional campaigns.
Not all fields apply to every person. The company said some information, including passwords, was encrypted, but did not specify the protection method. Credit card information was not stored in the affected service and was not compromised, it said.
As of November 5, Iris Ohyama reported no known misuse of personal information or related financial losses. The cloud provider, initial access method, and amount of data obtained remain undisclosed.
The company also suspended SIMPLE STYLE and Iris Tech Service's subscription and delivery-related websites as precautions. It reported no confirmed unauthorized access at those services. A separate Burger King Japan customer-data breach illustrates the risk posed by large collections of contact details even when payment information is not exposed.
Customer data risks and cloud security response
Iris Plaza began arranging individual notifications on November 5 and urged customers to replace passwords reused elsewhere. Contact details could support targeted phishing, as the RingCentral breach involving 1.6 million email addresses also demonstrates.
Organizations holding customer data in cloud environments can take these steps without assuming the still-undisclosed cause of the Iris Plaza intrusion:
- Control cloud access: Enforce least privilege and multifactor authentication; scan for exposed storage and configuration drift.
- Detect data movement: Review authentication and audit logs, and use data loss prevention controls to flag unusual transfers.
- Minimize stored data: Protect credentials and encryption keys, classify sensitive records, and delete information beyond retention requirements.
- Review third-party access: Audit vendor permissions, software dependencies, and incident notification obligations. The Frontline Education breach involving third-party software demonstrates the need to assess risks beyond direct cloud providers.
- Limit phishing exposure: Promote unique passwords, phishing-resistant authentication, and verified customer-notification channels.
- Test incident response plans: Rehearse cloud compromise scenarios, evidence preservation, containment, customer notification, and recovery from protected backups.
Iris Plaza has not announced when its store will reopen. Investigators must still establish how the attackers gained access and whether customer records were obtained, leaving the breach's full impact unresolved.
Read more: The DigiCert exposure of archived customer records shows why access reviews should include older systems and retained identity documents.