Security notice
Keep customer data in an outside cloud service? Iris Plaza says data on about 7.7 million people stored in one may have been taken.
On November 5, 2026, Iris Plaza, which runs the official online store of Japanese home goods and appliance maker Iris Ohyama, said data stored in an outside cloud service it uses may have leaked after unauthorized access. It found suspicious files in that service on October 28 and shut the store down the same day. The data covers about 7.7 million people: about 5.8 million current and former members, including names, addresses, phone numbers, email addresses, gender, birth dates and encrypted passwords, and about 1.9 million people who bought without an account or entered campaigns. Iris Plaza says card information was not stored in that cloud service and that it has had no reports of misuse so far. It has not named the cloud service or said how the attacker got in. This is not a software flaw you can patch, and there is no CVE. If your store copies customer data into outside services, those services need the same care as your store. (Iris Plaza notice, Nov 5)
What happened
- Found on October 28. Iris Plaza says it found suspicious files in an outside cloud service it uses on October 28, 2026, immediately stopped the Iris Plaza store and related systems, and began investigating. It confirmed unauthorized access by a third party and published a first report on October 29. (Iris Plaza notice, Nov 5)
- Data may have been taken. In its second report, on November 5, Iris Plaza says data kept in the outside cloud service may have leaked. It says the stored personal data covers about 7.7 million people, that it has confirmed the data may have been viewed or taken, and that it is still working out the actual number affected. (Iris Plaza notice, Nov 5)
- No misuse reported so far. Iris Plaza says it has had no reports of misuse or financial loss from this incident so far. (Iris Plaza notice, Nov 5)
- Reported. Iris Plaza says it reported to the police and Japan's Personal Information Protection Commission on October 29, and that it will continue the investigation with the help of the authorities and outside experts. (Iris Plaza notice, Nov 5)
- Other sites paused. Iris Plaza also took its SIMPLE STYLE home fashion store offline on October 28, and the Iris Group's appliance subscription and delivery and installation sites stopped taking new orders. It says it has found no unauthorized access to those services, or to Iris Plaza's shops on outside online marketplaces. (Iris Plaza notice, Nov 5)
- Not said. Iris Plaza has not named the cloud service or said how the attacker got in. (Iris Plaza notice, Nov 5)
What data, as of November 5
Iris Plaza says not every item applies to every customer. (Iris Plaza notice, Nov 5)
- Members, including former members: name, address, phone number, email address, gender, password and birth date, among others, for about 5.8 million people. It says some items, including passwords, are encrypted, and former members' passwords are not included.
- Non-members: name, address, phone number and email address for about 1.9 million people, including people who bought without an account or entered a campaign.
- Not included: credit card information, which Iris Plaza says was not stored in that cloud service.
Who should worry
- You have an Iris Plaza account, or you bought from Iris Plaza or entered one of its campaigns.
- You run an online store that sends customer data to outside services, such as email marketing, customer service, analytics, file storage, backups or data exports.
- You do not know which outside services hold copies of your customer list.
If you never used Iris Plaza and your store keeps no customer data in outside services, this notice does not apply to you.
What to do now
If you are an Iris Plaza customer. This follows Iris Plaza's advice.
- Change reused passwords. If you used your Iris Plaza password anywhere else, change it there. (Iris Plaza notice, Nov 5)
- Watch for fakes. Iris Plaza warns of fake emails, texts, calls, websites and social media accounts pretending to be it. It says it will never ask for passwords, PINs or codes, or ask you to type them into a link it sends. (Iris Plaza notice, Nov 5)
If you run an online store. These are general steps, not from Iris Plaza. We are not claiming any tool, including EverThread, would have prevented or caught this.
- List every outside service that holds your customer data. Include email marketing, help desk, analytics, file storage, backups and any place where exports or spreadsheets of customers end up.
- Lock down each one. Turn on two-step sign-in, remove old users and access keys, and make sure stored files are not public.
- Delete what you do not need. Old exports and former customers' data are still at risk while they sit in a service.
- Turn on alerts for new files, new users, large downloads and sign-ins from unusual places, where the service offers them. Iris Plaza noticed this through suspicious files. (Iris Plaza notice, Nov 5)
- Know how you would tell customers. Keep their contact route and a short warning about fake messages ready.
What to send your developer, agency or host
Iris Plaza, the official online store of Iris Ohyama, said on November 5, 2026 that data on about 7.7 million people stored in an outside cloud service it uses may have been taken after unauthorized access. Please list every outside service that holds a copy of our customer data, including email, help desk, analytics, file storage, backups and exports. For each one, please confirm two-step sign-in is on, remove old users and access keys, check that stored files are not public, turn on alerts for new files, new users and large downloads where available, and delete customer data we no longer need. Source: Iris Plaza notice of November 5, 2026.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It is about a breach at Iris Plaza. It matters to store owners because many stores keep copies of customer data in outside services they rarely look at.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see the cloud services, accounts or files your store uses behind the scenes, and we cannot tell you whether you were one of Iris Plaza's customers.
Were card numbers taken?
Iris Plaza says card information was not stored in the affected cloud service and was not affected. (Iris Plaza notice, Nov 5)
Is there anything to update?
Iris Plaza has not named any software or flaw, so there is no specific update to install.
Where can I follow official updates?
Iris Ohyama's notice (in Japanese). SecurityWeek also covered it in English. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Iris Ohyama: Iris Plaza online store suspension (second report): possible personal information leak due to unauthorized access to an outside cloud service, November 5, 2026, in Japanese, checked November 11, 2026
- SecurityWeek: Iris Plaza breach may have exposed data of 7.7 million customers, checked November 11, 2026