Cloud service breach exposes 7.7M Iris Ohyama customer records

Japanese appliance manufacturer Iris Ohyama discovered unauthorized access to a third-party cloud service supporting its Iris Plaza e-commerce platform, compromising personal information for roughly 7.7 million people. The breach was identified in late October and disclosed to authorities on October 29, affecting both registered and former members as well as non-member accounts.

The exposed records contained names, physical addresses, phone numbers, email addresses, gender, birth dates, and passwords—with encryption applied to passwords stored for active members only, while former members had no stored passwords. Credit card details were not stored in the compromised cloud environment. The company suspended Iris Plaza and related services immediately following discovery.

As of early November, no confirmed cases of data misuse or fraud tied to the exposure had been reported. The company stated it received no direct contact from attackers and has not yet identified who was responsible for accessing the third-party cloud service.