Iris Ohyama data breach: details of up to 7.7 million Iris Plaza shoppers may have leaked

If you have ever bought a rice cooker, a fan or a storage box from Iris Ohyama’s own online shop in Japan, you may already have had an email you didn’t expect. The company says the details of up to 7.7 million people may have leaked from a cloud service its store used.

The Iris Ohyama data breach began with one suspicious file. Iris Plaza, the group’s online store, found it on 28 October 2026 in an outside company’s cloud service. It shut the store the same day, then confirmed that someone had got in without permission.

It adds to a busy year for Japan data breaches in 2026, after Yamato and Nikkei confirmed customer records were taken. What makes this one stand out is its reach into ordinary homes: a household brand, and years of shoppers’ details kept in one place.

Who was in the Iris Plaza files

In its second notice, on 5 November, the company said data of about 7.7 million people was stored in the cloud service and may have been viewed or taken. That breaks down into about 5.8 million members, including people who had closed their accounts, and about 1.9 million non-members, such as guest buyers and people who entered campaigns.

For members, the stored items include name, address, phone number, email, gender, date of birth and password. Former members’ passwords were not stored. For non-members, it was name, address, phone number and email. Not everyone had every item. The company says some items, including passwords, were encrypted. It has not said how.

Two pieces of better news. Card details were not stored in that service, the company says. And as of 5 November it had no reports of misuse or money lost. No unauthorised access has been found at its shops on other online malls.

The Iris Plaza store, the SIMPLE STYLE home-fashion shop and the Iris Tech Service sites for appliance subscriptions and delivery have been closed since 28 October. The company says no break-in was found at Iris Tech Service. There is no reopening date.

What Iris Plaza Japan still has not said

The real number of people affected is still being worked out. The company has not named the cloud provider or explained how the attacker got in. A spokesperson told BleepingComputer the company had received no message from the attacker and had not identified who was behind it. We checked its news page again on 10 November; the 5 November notice was still the latest.

Caught up in the Iris Ohyama data breach? Do this first

The company’s own advice comes first. It is emailing people who may be affected, one by one, from 5 November. If you used your Iris Plaza password on any other site, change it there. Watch for fake emails, texts, calls, websites and social media accounts that pretend to be the company. Iris Plaza says it will never ask for passwords, PINs or codes through a link.

Beyond that, some general steps help after any leak. It is wise to change reused passwords everywhere they appear, and to turn on two-step sign-in where a site offers it. Scam messages after a breach often use your real name and address to look genuine; the Capcom breach showed how fast scam emails follow. If a message feels urgent, go to the company’s site yourself rather than clicking.

The notice covers the Japanese Iris Plaza store. It says nothing about Iris Ohyama’s shops in other countries, so we can’t say whether they are affected.

Quick disclosure, but old data kept too long

On balance, Iris Ohyama has handled the first days well. It shut the store within a day, told police and Japan’s privacy regulator, published two notices and began contacting people directly. That is the right order: protect, report, then explain.

The harder question is why so much was there at all. Data on people who had closed their accounts, and on guests who never signed up, sat alongside current members. In practice, many companies keep old customer records longer than they need to, and a breach is when that cost shows up. This is analysis, not a finding from the investigation, but it is the lesson most worth taking from the Iris Plaza data breach.

The count, the cause and the reopening date

Watch for three things: the final count of people affected, an explanation of how the attacker got in, and a date for the store to reopen. Until then, the most useful step is the simplest one. One password, used in one place, keeps one leak from becoming many.