Iris Plaza Says a Cloud Breach May Have Exposed 7.7 Million People. That Is a Count of Records Stored, Not Records Stolen, and Passwords Are in It
If you ever shopped at Iris Plaza, the online store of Japan's Iris Ohyama group, change the password on any other account where you used the same one, and expect fake emails, texts and calls that use your details. Iris Plaza found suspicious files in a cloud service it uses on October 28, shut down its online store, and said on November 5 that information on about 7.7 million people may have been exposed.
What the company has said
As reported by CyberInsider from the company's notices:
- October 28: Iris Plaza found suspicious files in a cloud service and shut down its online store and related systems.
- October 29: it disclosed the third-party access and reported it to the police and to Japan's Personal Information Protection Commission.
- November 5: it issued an update and began notifying customers.
The company confirms unauthorized access through an external cloud service. It has not named the provider, and says it has blocked the access route. It has not confirmed that data was actually taken, and says it is still investigating how many records leaked and how many people are affected. As of November 5 it had received no reports of misuse or financial loss.
What may be in the data
- About 5.8 million members and former members: names, addresses, phone numbers, email addresses, gender, passwords, dates of birth and other details. Former members' passwords are excluded.
- About 1.9 million non-members, such as guest shoppers and campaign participants: names, addresses, phone numbers and email addresses.
- Passwords and some other fields are reported to be encrypted. The company has not said how.
- Credit card data was not stored in the affected service.
Read the number carefully
The 7.7 million figure is the approximate number of people whose information was stored in the affected service. It is not a count of people whose data was stolen. Some headlines said the breach "exposes" 7.7 million customers. The company's own wording, as reported, is "may have been exposed." The 5.8 million and 1.9 million figures add up to 7.7 million, which fits that reading.
What to do
- If you used your Iris Plaza password anywhere else, change it there. This is the company's own advice, and it matters most because passwords are among the listed fields.
- Be suspicious of emails, texts, calls, websites and social accounts claiming to be Iris Plaza. The company says legitimate notifications will never ask for passwords, PINs, authentication codes or other sensitive information.
- Expect messages that quote real details such as your name, address or phone number. Having your real details does not make a message genuine.
- The store has no announced reopening date. The company says individual emails will follow.
Other group sites, including Simple Style and Iris Tech Service's subscription and delivery services, were also suspended as a precaution. The company says neither has confirmed unauthorized access or a leak.
How we know
We read CyberInsider's report of November 5. We could not open Iris Ohyama's own notice, which returned an access error to our fetch, so the dates, figures and quotes above are as that outlet reports them. We found no indicators, no named attacker and no CVE, so nothing was added to our feed.
Sources
CyberInsider, Iris Plaza cloud breach report, November 5, 2026. Iris Ohyama notice of November 5, 2026 (irisohyama.co.jp), not read directly.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.