Illustrative image: a cybersecurity concept. No photo of the Iris Plaza breach itself exists. Image: Wikimedia Commons / jaydeep_, CC0.
TL;DR — Iris Plaza, the online store of Japanese home-goods maker Iris Ohyama, says personal information of up to 7.7 million customers may have leaked after unauthorised access to an external cloud service. The store is offline, credit card data was not stored there, and anyone who reused their Iris Plaza password elsewhere should change it now.
📌 KEY HIGHLIGHTS
- Up to about 7.7 million people may be affected — around 5.8 million members (including former members) and around 1.9 million non-member customers.
- Data that may have been viewed or taken: names, addresses, phone numbers and email addresses; for members, also gender, date of birth and passwords (some encrypted).
- Discovered on 28 October 2026: a suspicious file was found on an external cloud service used by the store; unauthorised access was confirmed, the site was shut down, and the incident was reported to police and Japan's Personal Information Protection Commission on 29 October.
- Credit card data was not stored on the affected service, the company says, and no misuse of the data has been reported so far.
- Iris Plaza and the SIMPLE STYLE shop remain offline until the cause is found and fixes are in place; the company says it will email affected customers individually.
What happened in the Iris Plaza data breach?
Iris Plaza Co., which runs the official online store of Japanese home-goods maker Iris Ohyama, found a suspicious file on an external cloud service it uses on 28 October 2026. The company confirmed that a third party had gained unauthorised access, shut down the Iris Plaza site and related systems, and reported the incident to police and Japan's Personal Information Protection Commission the next day, 29 October.
The first public notice on 29 October announced only the temporary suspension of the store. The scale of the incident became clear in the company's second notice, published on 5 November 2026: personal information stored on that cloud service may have leaked, covering about 7.7 million people. The company stresses that the actual number of people affected is still under investigation — 7.7 million is the maximum that could have been exposed, not a confirmed count of stolen records.
What data may have leaked?
| Group | People possibly affected | Data possibly exposed |
|---|---|---|
| Members (including former members) | About 5.8 million | Name, address, phone number, email address, gender, password, date of birth (some items such as passwords encrypted) |
| Non-member customers | About 1.9 million | Name, address, phone number, email address |
| Payment card data | — | Not stored on the affected cloud service, according to the company |
Illustrative image: rows of servers in a data centre. No photo of the Iris Plaza breach itself exists, and this is not an Iris Ohyama facility. Image: Wikimedia Commons / Florian Hirzinger.
What Iris Plaza customers should do now
If you have an Iris Plaza account, change your password there as soon as the site returns — and change it immediately on any other service where you reused the same password. Iris Plaza itself asks customers who reused passwords to change them on those other services. Turn on two-factor authentication wherever it is offered, and watch your inbox for the company's individual notification email.
Expect phishing. The company warns that scam emails, texts, calls, fake sites and fake social media accounts pretending to be Iris Plaza are likely, and says it will never ask customers for passwords, PINs or authentication codes. Do not click links in unexpected messages about the breach; go to the company's official site directly instead.
Why it matters for World Tech readers
Iris Plaza is one of the biggest retail breaches in Japan's current wave of incidents — and it follows the same pattern as the others: the break-in came through a third-party or cloud service, not the company's own checkout. On the same day, NTT Docomo confirmed that up to 300,000 customer accounts leaked after unauthorised access to its online shop, while MUJI's operator said about 1.09 million records including credit card numbers may have leaked, and the Arara email-distribution breach exposed around 77 million email addresses. The DreamHost breach we covered this week showed the same shape in the US: attackers sat inside a supplier system for months before being found.
For readers outside Japan, the practical lesson travels well. A breach at a shop you barely remember using can still expose the password you reused everywhere else — and the phishing wave that follows a big leak is usually the part that causes real losses. A password manager and unique passwords per site are the cheapest fix.
Should you care?
✅ Yes — if you ever shopped at Iris Plaza: treat your details as exposed, change any reused password now, and stay alert for phishing messages using your name and address. ⏳ If you never used it: no action needed — but note the pattern, because the same reused-password risk applies to every other shop you do use.
FAQs
Was my credit card leaked in the Iris Plaza breach?
No, according to the company. Iris Ohyama says credit card data was not stored on the affected external cloud service, so card numbers were not part of this incident.
How many people are affected by the Iris Plaza data breach?
Up to about 7.7 million people may have had personal information viewed or taken — around 5.8 million members including former members, and around 1.9 million non-member customers. The company says the actual number is still under investigation.
Is the Iris Plaza site back online?
No. The Iris Plaza site and the SIMPLE STYLE shop remain offline until the cause is found and fixes are in place. The company has announced no restoration date and says it will email affected customers individually.
What should I do if I reused my Iris Plaza password on other sites?
Change it on every other service now, starting with email and banking, and turn on two-factor authentication. Iris Plaza itself advises customers who reused passwords to change them elsewhere, and warns it will never ask for passwords, PINs or authentication codes.
Takeaway: Iris Plaza's second notice turned a quiet site suspension into one of Japan's biggest retail breaches — up to 7.7 million customers possibly exposed through a cloud service. Change reused passwords now, and treat any breach message asking for your credentials as a scam.
Follow World Tech on TechByCountry for tomorrow's 6 PM update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
- Iris Ohyama — (Second notice) Iris Plaza EC site suspension / possible personal data leak from unauthorised access to an external cloud service (5 Nov 2026)
- WhatGotPwned — Today's data breaches, hacks & exploited CVEs (Iris Plaza entry, 5 Nov 2026)
- Kyodo News — Muji among latest firms hit by data breach, card data may have leaked
- The Japan Times — More data breaches hit Japan, including leak of 77 million email addresses
Comments
Post a Comment