Japanese home goods giant Iris Ohyama has confirmed a massive data exposure involving up to 7.7 million customer records following unauthorized access to an external cloud service. The incident, first detected on October 28, 2026, has led to a prolonged suspension of the company’s official online store, Iris Plaza, and several related group services which remain offline as of November 8.
The breach is one of the largest recent data security incidents in Japan, prompting the Japanese government to announce a 10 billion yen ($63 million) emergency cybersecurity package on November 6 to address a growing wave of sophisticated attacks against domestic infrastructure.
Scope of the Iris Plaza Data Exposure
The potential leak spans two primary categories of users who interacted with the Iris Plaza platform. According to company disclosures, the 7.7 million affected records are categorized as follows:
- 5.8 Million Registered Members: This group includes both current and former members. The exposed data includes names, physical addresses, phone numbers, email addresses, gender, dates of birth, and encrypted passwords. Notably, while former members’ contact details were included, Iris Ohyama stated that passwords for users who had already formally withdrawn from the service were not part of the exposure scope.
- 1.9 Million Guest Shoppers and Campaign Entrants: This category consists of individuals who made one-time purchases without creating an account or entered promotional campaigns. Their exposed data is limited to contact information, including names, addresses, phone numbers, and email addresses.
Despite the scale of the incident, Iris Ohyama confirmed that credit card information was not stored on the compromised cloud server. Financial data is handled through a separate payment gateway and is not believed to be impacted by this breach.
Timeline and Ongoing Service Suspension
The breach was identified on October 28 after security teams discovered a suspicious file within the company’s external cloud environment. Iris Ohyama issued an initial disclosure the following day, but the full scale of the 7.7 million records was not confirmed until a subsequent update on November 5.
In response to the discovery, the company immediately suspended the Iris Plaza online store and the Iris Tech Service. These platforms remain inaccessible while forensic investigators work to secure the environment and verify the integrity of the database. The company has not yet provided a definitive timeline for when these services will resume operations.
Mitigation and Government Response
The incident coincides with a sharp increase in cyber threats targeting Japanese corporations. The 10 billion yen emergency package announced by the government is intended to bolster “active cyber defense” measures, providing resources for faster threat detection and more robust recovery protocols for major enterprises.
Security analysts recommend that any Iris Plaza users who reuse the same password across multiple platforms change their credentials immediately on those other sites. While the passwords leaked in this breach were encrypted, sophisticated attackers can sometimes decrypt or “crack” such files if the encryption standards are dated or if the passwords themselves are weak.
Users are also advised to remain vigilant against phishing attempts. With 7.7 million names and contact details potentially in the hands of unauthorized actors, there is an elevated risk of targeted email or SMS scams masquerading as official Iris Ohyama communications or delivery notifications. More details regarding the company’s investigation are available via BigGo Finance and reporting from Island.