Iris Ohyama Store Breach May Expose 7.7M Customers

Iris Ohyama, the Japanese maker of storage boxes, LED lights, rice cookers and a long list of other home appliances, says personal data on up to about 7.7 million people may have been taken from a cloud service used by its official online store, Iris Plaza. The store has been offline since 28 October and still has no restart date.

What happened

According to the company's second notice, published on 5 November, staff found a suspicious file on 28 October in an external cloud service that Iris Plaza uses. The company shut down the store and related systems that day, confirmed that a third party had got in, and posted a first notice on 29 October. It reported the incident to Japanese police and to the Personal Information Protection Commission on the same day.

The follow-up investigation found that data stored in that cloud service may have been viewed or taken. Iris Plaza hasn't named the cloud provider, and it says it's still working out how many records actually left. BleepingComputer, which flagged the story on X, was told by a spokesperson that the company hasn't heard from the attacker and hasn't identified who did it.

What may have been exposed

The company splits it into two groups:

1. About 5.8 million members, including people who closed their accounts: name, address, phone number, email address, gender, date of birth and password. Passwords and some other fields were stored encrypted, the company says, without saying how. There are no passwords for former members.
2. About 1.9 million non-members: people who bought as a guest or entered a campaign. Name, address, phone number and email.

Not everyone has every field exposed. Card numbers weren't kept in that cloud service and weren't affected, and Iris Plaza's shops on outside marketplaces show no sign of a breach so far. The company also took its SIMPLE STYLE home-fashion site offline, along with Iris Tech Service's appliance subscription and delivery-and-installation sites, as a precaution, though it hasn't found a breach there. As of 5 November it had no reports of misuse or money lost.

Why it matters

A name, home address, phone number and date of birth together are what scammers need to sound convincing. That's the real risk here, more than the encrypted passwords. Iris Plaza says it began emailing affected customers on 5 November, which also gives fraudsters a perfect cover story: a fake "Iris Plaza security notice" landing in the same week as the real one.

My take: what to do if you ever bought from Iris Plaza

Most readers outside Japan won't have an Iris Plaza account, even if an Iris Ohyama fan heater or storage rack is sitting at home, because this breach is about the Japanese web store, not the products. But plenty of people living in or ordering from Japan will, and guest checkout counts. Here's what I'd do:

1. Change the password anywhere you reused it. This is the company's own main request. Iris Plaza itself is offline, so start with the other accounts that shared that password, email first.
2. Treat every "Iris Plaza" email or SMS as suspect. The company says its notices will never ask for passwords, PINs or verification codes, and never ask you to type them in through a link. Anything that does is fake.
3. Watch for phone and parcel scams. With addresses and phone numbers in play, fake delivery texts and calls claiming to be about your order are the obvious next move.
4. Use the official contact line only. The first notice lists Iris Plaza's contact centre (0120-108-824, weekdays and Saturday, 9:30 to 17:00 JST). Don't call numbers from a message you got.

The bigger lesson is one I keep repeating. Closing an account doesn't mean a shop deleted you, and checking out as a guest still leaves a record. It's the same advice I gave after the Capcom ID breach in October, which also hit a Japanese company and also didn't involve card data, and after the Chainalysis incident, where names and emails were the prize. A password manager with a unique password per site turns stories like this into a minor annoyance instead of a scramble.

I'll update this when Iris Plaza confirms the final count or a reopening date.