Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk

Iris Ohyama has taken its Iris Plaza online store offline after discovering a suspicious file on a third party cloud service, with personal data for about 7.7 million customers potentially at risk. The company says the affected environment held records for registered customers and people who bought products without accounts or joined promotions. It has not said when the site will reopen.

Breach details and exposed data

The retailer first disclosed the incident on October 29, one day after finding the suspicious file. Iris Plaza immediately suspended its website and associated systems and began investigating, later confirming unauthorized access. Iris Ohyama has since said the cloud environment contained personal information for about 5.8 million registered customers, including former members, plus about 1.9 million people who purchased products without creating an account or took part in promotional campaigns.

Payment data and ongoing investigation

The potentially exposed information includes names, addresses, phone numbers, email addresses, dates of birth, gender, and passwords. The exact information at risk varies between customers. Some data, including passwords, was encrypted, but the company has not explained what protection was used. It has advised customers who reused their Iris Plaza passwords elsewhere to change them. The retailer says it did not store payment information in the affected cloud service, so credit card details were not compromised.

Service impact and other stores

Iris Plaza's website remains down and the company has not given a reopening date. Orders are taking longer to ship, and customers trying to cancel a purchase may have to refuse delivery if a parcel arrives before cancellation is processed. Iris Plaza's stores on Rakuten, Yahoo! Shopping, and auPAY Market are still operating, and the company says it has found no evidence that those stores were affected.

Customer guidance and authorities

Iris Ohyama has reported the incident to Japanese authorities and says it will contact potentially affected customers individually. It has warned shoppers to watch for phishing emails, fraudulent calls, and fake websites impersonating the retailer. The company has not identified the cloud provider, explained how attackers entered the environment, or established whether any of the 7.7 million records left its systems.

Sources: The Register