Iris Plaza says a cloud service held data on 7.7 million people, and someone else may have it now

a Japanese appliance giant’s online store found “a suspicious file” in an outside cloud service on October 28, pulled the plug on the whole site, and a week later told 7.7 million people their names, addresses, and in many cases birth dates and encrypted passwords may have walked out the door. the cloud service is unnamed. the attacker is unnamed. the encryption is unexplained. the store is still offline. so, a normal Monday in retail.

what happened, per the company

from Iris Plaza’s November 5 notice (our translation from Japanese, kept literal on purpose):

• October 28, 2026: the company found a suspicious file in an external cloud service it uses, immediately stopped the Iris Plaza site and related systems, and began investigating. it confirmed unauthorized access by a third party.
• October 29: first notice published. the company reported the incident to the police and to Japan’s Personal Information Protection Commission the same day.
• November 5: second notice. data stored on the cloud service may have leaked. total stored personal data: about 7.7 million people. “at this time” the company has confirmed the possibility that the data was viewed or acquired, and is still investigating the real count.

note the careful verbs. “may have leaked.” “possibility it was viewed or acquired.” this is a company that knows someone was inside and does not yet know what they took. that is honest. it is also the scariest sentence a breach notice can contain, because it usually means the logs that would answer the question are not as complete as everyone assumed.

who and what, broken out

the notice splits the 7.7 million into two groups, as of November 5:

• members, including people who already closed their accounts: about 5.8 million. name, address, phone number, email address, gender, password, date of birth, and similar fields.
• non-members: about 1.9 million. people who bought without registering or entered a campaign. name, address, phone number, email address.

three footnotes the company added, which matter more than the headline:

• not every field leaked for every customer. it depends on what each person registered.
• some items, including passwords, are encrypted. the notice does not say how. “encrypted” in a breach notice can mean a salted slow hash, a fast hash, or reversible encryption with a key that may or may not have been sitting next to the data. we do not know which, and the notice does not say. if you are a member, act as though it was the bad one.
• password data is not included for former members who closed their accounts. so the company deleted passwords on account closure but kept names, addresses, and birth dates. data minimization, half applied.

what was not hit, per the company

• credit card data: not stored in the affected cloud service and not affected by the unauthorized access.
• Iris Plaza storefronts on outside marketplaces: no unauthorized access or leakage confirmed so far.
• SIMPLE STYLE, the company’s home-fashion store, has been offline since October 28 as a precaution. the Iris Group’s appliance subscription service and furniture and appliance delivery-installation service, run by Iris Tech Service, also took their sites down and stopped new applications the same day. the notice says no unauthorized access or leakage has been confirmed for either.

taking sister sites offline when nothing is confirmed there is the right call. it is also a hint that these services share more plumbing than the org chart suggests.

what we do not know, and will not pretend to

• which cloud service. the notice says “external cloud service.” not the vendor, not the product, not whether it was a misconfiguration, stolen credentials, or a vendor-side compromise.
• who. no group named, no ransom mentioned, no leak site cited in the company’s notice.
• how long they were inside before the suspicious file was found.
• the password scheme. covered above.

if you see someone online with a confident answer to any of these, ask them for their source. ours is the company notice, and it does not say.

the pattern, again

yesterday it was a French bank saying attackers came in through a service provider. today it is a Japanese retailer saying the data sat in “an external cloud service.” the entry point keeps moving one hop away from the company whose name is on the notice. that is not a coincidence. it is where the data actually lives now. the store front is a thin shell over somebody else’s storage, and the security review of that storage was, in a lot of shops, a vendor questionnaire with a checkbox that said “encrypted at rest: yes.”

encrypted at rest does not help when the attacker logs in.

if you run something like this

• inventory where customer records actually sit. not the app. the buckets, SaaS tenants, analytics exports, and “temporary” migration copies. the place you found the suspicious file is rarely the place you were watching.
• log reads, not just writes. “we cannot rule out that data was viewed” is what you say when object-level read logging was off or not retained. turn it on before you need it.
• delete what you do not need. former customers’ birth dates are a liability with no revenue attached.
• say how passwords are stored in plain words in your own docs, so that if you ever write a notice like this you can say “salted and hashed with a slow algorithm” and mean it.

if you are one of the 7.7 million

• change the password anywhere you reused your Iris Plaza password. the company asks for exactly this.
• expect phishing. the company says it will contact affected people individually by email and similar channels, and that it will never ask for passwords, PINs, or authentication codes, or ask you to enter them via a link in an email or SMS. it also warns about fake sites, fake social accounts, and calls impersonating the company or authorities. anything that does ask is not them.
• your address and birth date do not rotate. watch for account recovery attempts that lean on them.

if you cannot list every third-party service that stores your customer data, and whether reads there are logged, that list is the first thing to build. Book a slot with Dark Edge Consulting.

sources

• Iris Ohyama / Iris Plaza Co., Ltd., second notice on the Iris Plaza site suspension and possible personal data leakage via unauthorized access to an external cloud service (Japanese, November 5, 2026)
• SecurityWeek, “Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers” (Ionut Arghire, November 9, 2026)