The Iris Plaza data breach may have exposed personal information held for about 7.7 million people after an attacker accessed an external cloud service used by the Japanese online retailer. Iris Ohyama said the affected data could include records for 5.8 million current and former members and 1.9 million non-members. The company has not confirmed that all those records were taken; the actual number of affected people remains under investigation.
Iris Plaza data breach began with an external cloud service
Iris Plaza said it found a suspicious file in an external cloud service on October 28, 2026. It shut down the online store and related systems that day, began investigating and confirmed unauthorized access by a third party. The company reported the incident to police and Japan’s Personal Information Protection Commission on October 29, then published a more detailed update on November 5.
The company’s second notice says the affected cloud service held data relating to approximately 7.7 million people. That is the size of the potentially exposed dataset, not a confirmed victim count. Iris Ohyama says investigators are still determining whether the information was viewed or acquired and how many records were actually affected. Its official November 5 notice provides the current breakdown.
What information the Iris Plaza data breach may expose
For current and former members, the potentially affected fields include names, addresses, telephone numbers, email addresses, gender and dates of birth. The company says password data was stored in encrypted form for active members; it does not store passwords for former members. For non-members, including guest purchasers and campaign entrants, the listed fields include names, addresses, telephone numbers and email addresses. The fields vary by individual account and transaction history.
Iris Ohyama says credit-card information was not stored in the affected cloud service and was not exposed through this incident. As of November 5, the company had received no reports of fraudulent use or financial losses linked to the event. Independent coverage by BleepingComputer also reports that the cloud provider and the attacker have not been publicly identified.
Why the Iris Plaza data breach matters beyond one retailer
The incident highlights the risks created when customer records are copied or stored in external services operated outside a retailer’s core storefront. A cloud service may contain data from multiple customer journeys, including purchases made without an account and old membership records. That makes data minimization, access controls, retention rules and visibility into third-party environments important parts of retail security.
The company also suspended its SIMPLE STYLE home-furnishings site and certain Iris Tech Service subscription and delivery services as a precaution. It said it had not confirmed unauthorized access or information leakage at those related services. The wider operational impact shows how a security incident in one data environment can interrupt several customer-facing services at once. Kernel.news previously reported on cyberattacks affecting supermarket refrigeration systems, another example of security failures reaching physical retail operations.
What customers should do after the Iris Plaza data breach
Anyone who used Iris Plaza should be alert to messages that appear to relate to orders, refunds, deliveries or account security. Do not follow unexpected links or provide passwords, PINs or one-time codes. The company says it will not ask customers to provide such information through email or SMS links. Customers who reused an Iris Plaza password elsewhere should change that password on the other service and use a unique credential.
The company has not announced a reopening date for Iris Plaza. It says it will contact potentially affected customers individually as the investigation advances. Until it publishes a confirmed impact count and more technical detail about the cloud incident, the careful conclusion is that data on up to 7.7 million people may have been accessible—not that 7.7 million confirmed records were stolen.
Sources: Iris Ohyama, November 5, 2026; BleepingComputer, November 6, 2026; SC Media, November 8, 2026.
