Iris Ohyama says a cloud breach may have exposed data on up to 7.7 million Iris Plaza shoppers

7.7 million people are potentially affected: roughly 5.8 million current and former Iris Plaza members and 1.9 million non-members [2] [3] .

Member records can include name, address, phone, email, gender, date of birth and an encrypted password; credit card data was not in the breached cloud service [1] [3] .

Iris Ohyama, the Japanese maker of household goods and appliances, says personal data on up to 7.7 million customers of its Iris Plaza online store may have been viewed or taken after a third party broke into an external cloud service the store uses [1] [2] .

The company found a suspicious file in that cloud service on Oct. 28, shut down Iris Plaza and related systems the same day, and confirmed unauthorized access during its investigation [3] . It disclosed the incident on Oct. 29 and reported it to Japan's Personal Information Protection Commission and the police that day, according to BleepingComputer [1] . A second notice on Nov. 5 put numbers on the exposure [2] .

The cloud service held records on 5.8 million members, including people who had closed their accounts, and 1.9 million non-member shoppers [3] . Member data can include name, address, phone number, email address, gender, date of birth and password; former members' passwords were not stored, and active members' passwords were encrypted, though the company has not said how [1] [3] . Non-member records cover name, address, phone number and email [3] . Not every field applies to every person, and Iris Ohyama says it is still working out how many records were actually taken [1] [3] .

Credit card information was not kept in the affected service [1] . The company says it has blocked the access route, began emailing affected customers on Nov. 5, and had received no reports of misuse or financial loss [3] . It has not named the cloud provider, explained how the intruder got in, or identified the attacker, and it says no one has contacted it claiming the breach [1] .

Iris Plaza remains suspended with no reopening date; the company says it will restart once the cause is identified and prevention measures are in place [3] . Its SIMPLE STYLE store and sites run by Iris Tech Service, covering appliance subscriptions and delivery and installation, were also taken down [1] . Iris Plaza's storefronts on outside shopping malls show no sign of unauthorized access [3] .

The Nov. 5 figures came a day before Japan's government approved a ¥10 billion emergency cybersecurity package in response to a wave of breaches at companies and agencies.