Iris Ohyama Data Breach Affects 7.7 Million Customers

• •7.7 million individuals' data may have been exposed in the breach.
• •The breach involved unauthorized access to a third-party cloud service used by Iris Plaza.
• •No credit card information was stored in the compromised service, and no misuse has been reported.

Iris Ohyama disclosed a data breach involving its Iris Plaza online shopping platform, potentially exposing personal information of 7.7 million individuals. The breach was linked to unauthorized access to a third-party cloud service, discovered on October 28, 2026. Affected individuals include approximately 5.8 million registered members and 1.9 million non-members. The compromised data may include names, addresses, phone numbers, email addresses, gender, dates of birth, and encrypted passwords, while credit card information was not stored in the affected service. The company suspended the Iris Plaza site and related systems immediately after the breach was detected and reported the incident to Japan's Personal Information Protection Commission and local police on October 29. As of November 5, there have been no reports of misuse or financial loss related to the exposed information. The investigation is ongoing, and the company has not yet identified the attacker or the method of access.