Iris Ohyama cloud breach leaks personal data of 7.7 million customers
TL;DR
Iris Ohyama experienced a data breach involving a third-party cloud service used by its Iris Plaza online store. The incident potentially exposes the personal details and encrypted passwords of up to 7.7 million customers. Affected users should monitor their accounts and update credentials used on other platforms.
What happened
Iris Ohyama discovered unauthorized access to an external cloud service used by the Iris Plaza online store late last month. Following the discovery of a suspicious file, the company suspended the Iris Plaza website, the SIMPLE STYLE online store, and related systems for Iris Tech Service Co., Ltd. on October 28.
The breach involves up to 5.8 million registered or former members and 1.9 million non-members. While the company is still calculating the exact number of impacted individuals, the exposed data includes full names, physical addresses, phone numbers, email addresses, gender, dates of birth, and account passwords. Passwords for active members were stored in an encrypted format, though the specific encryption method was not disclosed. Credit card information was not stored in the compromised service.
Why it matters
This is a massive exposure of personally identifiable information (PII) that can be used for highly targeted phishing or identity theft. Because the leaked data includes physical addresses and dates of birth alongside email addresses, attackers have a high-quality dataset for social engineering. Even though passwords were encrypted, the sheer volume of records, potentially 7.7 million, presents a significant risk to the privacy of the Iris Ohyama customer base.
Who is affected
- Iris Plaza online store customers
- Iris Tech Service Co., Ltd. customers (including home appliance subscribers and furniture/appliance delivery/installation users)
What to do now
- Change passwords for any other online accounts that share the same credentials used for Iris Plaza.
- Monitor your email and financial accounts for suspicious activity or unauthorized access.
- Watch for targeted phishing attempts that use your specific personal details, such as your name, address, or date of birth.
What we don't know yet
- The specific identity of the unauthorized third party or the perpetrator.
- The exact number of records and individuals impacted within the 7.7 million estimate.
- Whether a ransom demand was made or if the attack was a targeted theft.
- The specific encryption method used for member passwords.
Sources
