Japanese household products manufacturer Iris Ohyama has disclosed a security incident involving its Iris Plaza online shopping platform, warning that personal information associated with approximately 7.7 million people may have been exposed. The company confirmed unauthorized access to an external cloud service but has not established how many customer records were actually obtained.
The incident came to light on October 28, 2026, when Iris Plaza discovered a suspicious file in the cloud environment used by its online store. The company immediately suspended the shopping platform and related systems while investigating the activity. Unauthorized third-party access was subsequently confirmed, prompting an initial public announcement on October 29.
In an updated disclosure published on November 5, Iris Ohyama explained that the potentially affected database contained information relating to approximately 5.8 million registered customers, including former members, and another 1.9 million people who had purchased products or participated in promotional campaigns without creating accounts.
For registered customers, the potentially exposed information includes names, residential addresses, telephone numbers, email addresses, dates of birth, gender, and account passwords. The company said passwords were stored in encrypted form but did not specify the encryption methods used. Passwords belonging to former members were not retained.
Information associated with nonregistered customers was more limited, consisting primarily of names, addresses, telephone numbers, and email addresses. The precise information at risk varies depending on the details individuals previously provided.
Iris Ohyama emphasized that credit card information was not stored in the compromised cloud environment and therefore was not affected by the incident. The company also reported no evidence of related unauthorized access involving its stores on external online marketplaces.
The disruption extended beyond Iris Plaza. As a precaution, the company temporarily suspended SIMPLE STYLE, its home furnishings shopping website, along with certain services operated by Iris Tech Service. These included home appliance subscriptions and furniture and appliance delivery services.
According to the company, investigators have not identified unauthorized access or information leakage involving those additional services.
Iris Plaza notified Japanese police and the country’s Personal Information Protection Commission on October 29. External cybersecurity specialists are assisting with the investigation, while the company works to establish the intrusion method and determine the actual extent of the exposure.
As of November 5, Iris Ohyama had received no reports of personal information misuse or financial losses linked to the breach. The retailer has begun contacting potentially affected customers and recommends changing passwords reused on other websites. It also warned customers about fraudulent emails, messages, and websites impersonating the company.
Iris Plaza remains suspended while security improvements and recovery work continue. No reopening date has been announced.