Iris Plaza Breach: Unauthorized Access to External Cloud May Have Exposed Personal Data of Approximately 7.7 Million People

1. Basic Information

• Article Title: (Second Report) Notice Regarding Temporary Suspension of Iris Plaza E-Commerce Site
• Publisher: Iris Ohyama
• Publication Date: 2026-11-05
• Collection Date: 2026-11-09T08:26:08+09:00
• Source: Iris Ohyama
• Related Source: BleepingComputer: Iris Ohyama data cloud breach exposes info of 7.7 million customers
• Related Malware: None identified
• Related Threat Group: None identified
• CVE: None identified
• Target Products/Services: Iris Plaza, external cloud services used by the platform
• Severity: Critical
• Severity Basis: Unauthorized third-party access to an external cloud service has been confirmed. The service stored personal information for approximately 7.7 million people, including names, addresses, phone numbers, and email addresses. While the exact number of individuals and specific data items viewed or acquired remains undetermined, the scale of the target data and the potential inclusion of passwords necessitate prompt investigation and user protection.

2. Executive Summary

A third party gained unauthorized access to an external cloud service used by Iris Plaza, potentially viewing or acquiring registration, purchase, and campaign entry information for approximately 7.7 million users. The 7.7 million figure refers to the number of people whose information was stored on the service, not the confirmed number of people whose information was viewed or acquired. Credit card information was not stored on this cloud service. As of November 5, 2026, Iris Ohyama stated that it has not confirmed any reports of unauthorized use or financial damage resulting from this incident.

3. Attack Flow

The following is the timeline of discovery and response confirmed in public disclosures:

1. On October 28, 2026, suspicious files were discovered within the external cloud service used by Iris Plaza. The company suspended Iris Plaza and related systems, implemented initial containment measures such as blocking unauthorized access paths, and launched an investigation. This investigation confirmed unauthorized third-party access to the external cloud service.
2. On October 29, 2026, the company published its first report and notified the police and the Personal Information Protection Commission.
3. Subsequent investigations revealed that personal information for approximately 7.7 million users stored on the service may have been viewed or acquired. The actual number of accessed records and specific items remains under investigation. The entry path, use of credentials, and presence of vulnerabilities have not been disclosed.
4. On November 5, 2026, the company published its second report. The actual number of leaked records and affected individuals remains under investigation.

4. Attacker Positioning and Prerequisites

• A third party that reached the external cloud service.
• The attacker's identity, initial intrusion vector, credentials used, vulnerabilities exploited, and tools utilized have not been disclosed.

5. Observer Perspectives

Victim Perspective

• The situation is identified through service suspensions caused by the discovery of suspicious files on the operator side or through notifications from the operator.
• For individual users, which specific data items were actually viewed or acquired has not been determined at this time.

Administrator Perspective

• Specific details of management log records have not been disclosed. Depending on audit configurations, potential investigation candidates include external cloud authentication and audit logs, object access, file creation and modification, downloads, configuration changes, and management account operations.

6. Success and Failure Conditions

Success Conditions

• The attacker is able to gain unauthorized access to the external cloud service. Specific success conditions for the unauthorized access have not been made public.
• There is authorization or a path to reach customer information on the target service. The actual scope of viewed and acquired data remains undetermined.

Failure Conditions and Countermeasures

• Publicly disclosed initial response measures include blocking unauthorized access paths and suspending related systems. General supplementary countermeasures include revoking management accounts, API keys, and sessions, and re-verifying authentication settings and permissions to prevent continuous access.
• For evidence preservation and impact investigation, preserve cloud audit logs and object access logs to determine which data was viewed or acquired.
• Review password storage methods and impact scope, and provide individual password reset instructions to affected users. The company stated that some items, including passwords, are encrypted, but specific protection methods have not been disclosed.

7. Potential Impact of a Successful Compromise

• Personal information such as names, addresses, phone numbers, and email addresses may be viewed or acquired.
• Member data may also include dates of birth, genders, and passwords. However, password information for former members is excluded.
• Secondary damage such as phishing, impersonation, or password reuse utilizing the acquired information may occur.
• Credit card information was not stored on the affected external cloud service.

8. Observable Logs

The following are proposed investigation and detection steps for your organization, not observations reported in the public disclosures. Confirm within the scope of available logs:

• Email: Check for suspicious password resets, phishing impersonating Iris Plaza, and notification delivery histories sent to users.
• Proxy / SWG / DNS: Check management device connections to external cloud management consoles and APIs, unusual destinations, and abnormal high-volume traffic. Direct communications from the attacker to the cloud may bypass internal proxies.
• Endpoint / EDR: Check management devices for credential theft, browser session theft, and suspicious file or script execution.
• Identity / IdP: Check for successful management account logins, MFA, sessions, token issuance, role changes, and credential resets.
• SaaS / Cloud: Check for object reads and downloads, file creations and modifications, bulk exports, API calls, and IAM/access policy changes.
• Network: Check for sudden traffic spikes with the external cloud or data transfers during unusual hours. However, the specific provider and utilized features have not been disclosed.

9. Assessment of Attack Success

Confirmed in Public Information

• Public Information: Iris Ohyama confirmed unauthorized third-party access to an external cloud service. However, whether this was achieved via malware execution or successful authentication has not been disclosed, and the success or failure of those vectors remains unconfirmed.
• Scope: Unauthorized access to the external cloud has been confirmed. Meanwhile, the number of individuals and items whose personal information was actually viewed or acquired remains undetermined, and the 7.7 million figure refers to the number of people whose information was stored on the service.

Internal Determination Criteria

• Separate cloud logins/session establishments, object accesses, exports/downloads, and subsequent configuration changes, verifying each stage through audit logs.

10. Investigation Playbook

The following is a general investigation playbook for your organization, not a description of actions confirmed in this incident:

• Trigger: Initiate based on vendor notifications, suspicious files, unknown IP logins to the external cloud, bulk access, or configuration changes.
• Initial Verification: Inventory affected services, management accounts, API keys, sessions, access policies, stored data, and recent normal operations.
• Endpoint: Preserve management devices and browser profiles to investigate potential credential and session theft.
• Authentication and Cloud: Chronologically map logins, MFA, tokens, IAM, object reads/downloads, exports, file modifications, and audit settings.
• Subsequent Operations: Check for account takeover, phishing, password reuse, and unauthorized configuration changes utilizing acquired information.
• Containment: Block access paths, rotate/revoke credentials, API keys, and sessions, and enforce the principle of least privilege.
• Determination Categories: Separate unauthorized cloud access, data viewing, data acquisition, external exfiltration, and secondary damage to users.

11. Defense and Detection Ideas

The following are general defense and detection proposals not based on actual observations from this incident:

• Single Events: Prioritize management logins from unknown IPs or unusual regions, MFA setting changes, bulk exports, and audit log stoppages.
• Chronological Correlation: Correlate abnormal logins -> role/policy changes -> massive object reads/downloads -> log deletion/stoppage.
• Hunting: Review management accounts, service accounts, API keys, object accesses, and file creations/modifications including those prior to October 28.
• Log Deficiencies: Providers, services, retention periods, and audit settings are undisclosed. If provider-side logs are unobtainable, supplement with management device, IdP, network, and application logs.
• Priority Controls: Implement phishing-resistant MFA, management account segregation, short-lived tokens, least privilege, tamper-resistant audit logs, and data export detection.

12. Facts, Inference, and Hypothesis

Facts

• On October 28, 2026, suspicious files were found within the external cloud service, prompting the suspension of related systems and the initiation of an investigation.
• Unauthorized third-party access to the external cloud service was confirmed.
• The service stored information for approximately 5.8 million current and former members and approximately 1.9 million non-member purchasers and campaign entrants.
• Stored information included names, addresses, phone numbers, and email addresses. Member data may also include dates of birth, genders, and passwords (password information for former members is excluded).
• The company stated that some items, including passwords, are encrypted, but specific protection mechanisms have not been disclosed.
• The 7.7 million figure refers to the number of people whose information was stored on the service; the actual number of people and specific items viewed or acquired remains under investigation.
• Credit card information was not stored on the service, and as of November 5, 2026, the company has confirmed no reports of unauthorized use or financial damage resulting from this incident.
• On October 29, 2026, reports were made to the police and the Personal Information Protection Commission.

Inference

• It is necessary to integrate external cloud authentication, object access, and export logs to separately determine simple service intrusion versus data acquisition.
• Because passwords may be included in the targets, secondary damage countermeasures are required based on the security of the storage method and password reuse status.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Additional Investigations."

13. MITRE ATT&CK Mapping

Because initial intrusion vectors, credentials used, vulnerabilities, and data acquisition operations have not been disclosed, no specific MITRE ATT&CK techniques are mapped at this time.

14. Unknowns and Additional Investigations

• The external cloud provider and service name, initial intrusion vector, attacker, compromise duration, and nature of the suspicious files remain undisclosed.
• The number of individuals and items actually viewed or acquired, presence of data exfiltration, and password protection methods remain undetermined or undisclosed.
• The accounts used in the unauthorized access, authentication methods, vulnerabilities, source IPs, and operational details remain undisclosed.

15. Impact on SOCs and Organizations

When investigating compromises involving e-commerce platforms and external cloud services, organizations should distinguish the number of people whose information was stored from the confirmed number affected. Unauthorized cloud access and data acquisition must be established separately. Verify audit log retention including third-party vendors, MFA and segregation for management accounts, data export detection, and target identification supporting user notifications during normal operations.

16. Summary by Role

• SOC Teams: Chronologically check cloud logins, IAM, object reads/downloads, and exports, and separately determine unauthorized access versus actual data acquisition.
• Administrators: Revoke management credentials, sessions, and API keys, preserve permissions and audit logs, and identify affected targets.
• Users: Check official announcements, avoid opening suspicious email links, and update passwords if the same password is used across other services.