Iris Ohyama second notice November 5, 2026; first notice and regulator notification October 29, 2026; BleepingComputer report November 8, 2026
A Suspicious File in Someone Else's Cloud: Iris Plaza Counts Up to 7.7 Million People in a Third-Party Breach
The store went dark the same day the file was found, and the count took another week. Iris Ohyama, the Japanese manufacturer behind the Iris Plaza online store, found a suspicious file on October 28 in an external cloud service the store used, suspended Iris Plaza and related systems that day, including its SIMPLE STYLE store and its appliance subscription and installation sites, and confirmed unauthorized access by a third party in a first notice on October 29, the same day it notified the Japan Personal Information Protection Commission and the police. Its second notice, published November 5 and reported in English on November 8, puts the possible scope at up to 7.7 million people: about 5.8 million registered and former members, and about 1.9 million non-members who bought without an account or entered campaigns. The data that may have been accessed varies by person and covers names, physical addresses, phone numbers, email addresses, gender, dates of birth and account passwords; passwords for active members were stored in encrypted form, with the scheme unspecified, and no passwords were stored for former members. Credit card information was not stored in the affected cloud service. Two limits define what is not yet known: the company is still determining how many records were actually accessed, so 7.7 million is the population stored on the service rather than a confirmed exposure count, and as of November 5 it had received no reports of misuse or financial loss tied to the incident. The company told BleepingComputer it received no direct communication from the attacker and has not identified the perpetrators, and it has not named the cloud provider or explained how the suspicious file arrived. It is contacting people whose information may have been exposed by email as the investigation proceeds.
Executives
Read the headline number the way the company wrote it: 7.7 million is everyone whose data sat on the service, not a count of records proven taken, and the distance between those two figures is where the next month of this incident will be spent. The decision worth copying is the first-day one: the store and its sibling services were suspended on discovery, before scope was known, which is the trade most leadership teams hesitate over. Ask whether your own incident plan names, in advance, who can take a revenue system offline on a suspicious file, and whether your cloud contracts give you the logs and the timeline you would need to draw the same stored-versus-accessed distinction this company is now drawing in public.
CIO / CISO
This is a third-party storage incident, so the governing questions are contractual and architectural. Which customer data classes sit with each external provider, in what form, and with what access logging you can actually obtain during an incident; whether passwords and identity fields need to share a store with order data at all; and whether your vendor notices would let you state, as this one does, what was not in the affected system, here card data. Note the notification sequence for your own playbook: suspension and regulator notification inside a day, a scoped second notice a week later, and direct contact with affected people run in parallel rather than after the count is final.
Engineers
Take the detection shape seriously: the tripwire here was a suspicious file in cloud storage, not an alert from the storefront. Review what file-integrity and object-change monitoring covers your own external storage, who sees an unexpected object appear, and whether store, subscription and installation systems share services whose suspension would cascade the way it did here. For the credential half, the record says active member passwords were encrypted with no scheme named; in your own estate, be able to name the scheme and the key custody for every stored credential class, because that sentence is the one customers and regulators will ask you to complete.
Everyone (non-IT)
If you shopped at Iris Plaza or entered one of its campaigns, watch for a direct email from the company and treat unexpected messages about this incident with care, since the exposed fields, name, address, phone, email and birth date, are enough to build a convincing fake. Your card details were not in the affected system, per the company, and no misuse had been reported as of November 5. If you reused your Iris Plaza password anywhere else, change it there too; that step costs minutes and does not depend on how the final count comes out.