Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used.

The company discovered the incident late last month and publicly disclosed it with limited details, along with an announcement that the site would be temporarily suspended.

In an update earlier this week, the company said it had discovered a suspicious file in an external cloud service used by the Iris Plaza online store.

“We immediately suspended Iris Plaza and related systems and began an investigation. We confirmed unauthorized access by a third party and disclosed it in our first notice on October 29,” [machine translated] the company said.

The investigation has confirmed that customer data stored in the compromised external cloud service may have been accessed by unauthorized actors.

While the company is still trying to determine the number of records exposed and how many people are impacted, it notes that the impact extends to up to 5.8 million registered members and former members, and 1.9 million non-members.

Iris Plaza is the online storefront for the Iris Ohyama Group, a major Japanese manufacturer of household products ranging from storage units and LED lighting to home appliances and garden accessories.

According to the company's notification, the following information may have been exposed:

• Full names
• Physical addresses
• Phone numbers
• Email addresses
• Gender
• Dates of birth
• Account passwords

The exposed data types vary per individual. For example, no passwords are stored for former members.

Iris Plaza said it stores passwords for active registered members in encrypted form, though it did not specify which encryption scheme it uses.

The company also said that credit card information was not stored in the affected cloud service.

As of November 5, Iris Plaza had received no reports of misuse of the exposed information or financial loss tied to the incident.

In response to the incident, the company’s online store (SIMPLE STYLE) and related systems were suspended on October 28.

The same applies to websites for Iris Tech Service Co., Ltd. services, including home appliance subscriptions and furniture and appliance delivery and installation.

Japan’s Personal Information Protection Commission and police were notified on October 29, 2026.

BleepingComputer has contacted Iris Plaza to learn more about the attack and whether a ransom payment has been demanded. A spokesperson told us that they received no direct communications from the attacker and have not identified the perpetrators.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.