---
title: Iris Plaza: personal data on about 7.7 million people may have leaked from an external cloud service used by its Japanese e-commerce site | ctxsec
url: https://ctxsec.com/items/iris-plaza-external-cloud-breach-7-7-million-nov-5
description: "Iris Plaza, the Iris Ohyama group company that runs the official Iris Plaza online store, said in a Nov 5 follow-up that data kept in an external cloud service may have been viewed or taken after unauthorized access. The company found a suspicious file in that cloud service on Oct 28, immediately stopped Iris Plaza and related systems, confirmed unauthorized access, and published a first notice on Oct 29. The stored personal-data set covers about 7.7 million people: roughly 5.8 million current and former members (names, addresses, phone numbers, email addresses, gender, dates of birth and, for some, encrypted passwords) and about 1.9 million non-members who had bought something or entered a campaign without registering (names, addresses, phones and emails). Not every field applies to every person. Iris Plaza says credit-card data was not stored in the affected cloud service and was not impacted, that its shops on other e-commerce malls show no related unauthorized access, and that it has not received reports of misuse or financial harm as of the Nov 5 notice. It reported the incident to police and Japan's Personal Information Protection Commission on Oct 29. The actual number of records obtained is still under investigation."
status: "official (Iris Plaza / Iris Ohyama second report, Nov 5); first notice Oct 29; leak count still under investigation"
published: 2026-11-08
---

> Iris Plaza, the Iris Ohyama group company that runs the official Iris Plaza online store, said in a Nov 5 follow-up that data kept in an external cloud service may have been viewed or taken after unauthorized access. The company found a suspicious file in that cloud service on Oct 28, immediately stopped Iris Plaza and related systems, confirmed unauthorized access, and published a first notice on Oct 29. The stored personal-data set covers about 7.7 million people: roughly 5.8 million current and former members (names, addresses, phone numbers, email addresses, gender, dates of birth and, for some, encrypted passwords) and about 1.9 million non-members who had bought something or entered a campaign without registering (names, addresses, phones and emails). Not every field applies to every person. Iris Plaza says credit-card data was not stored in the affected cloud service and was not impacted, that its shops on other e-commerce malls show no related unauthorized access, and that it has not received reports of misuse or financial harm as of the Nov 5 notice. It reported the incident to police and Japan's Personal Information Protection Commission on Oct 29. The actual number of records obtained is still under investigation.

[← Cybersecurity News](/news) · [markdown](/items/iris-plaza-external-cloud-breach-7-7-million-nov-5.md)

official (Iris Plaza / Iris Ohyama second report, Nov 5); first notice Oct 29; leak count still under investigation

2026-11-08

### Iris Plaza: personal data on about 7.7 million people may have leaked from an external cloud service used by its Japanese e-commerce site

- **Who:** about 5.8 million member records (including people who already closed accounts) and about 1.9 million non-member records.
- **Not in the affected service (per Iris Plaza):** credit-card data. Withdrawn members' passwords were not in the member-data set described above.
- **Also taken offline as a precaution on Oct 28:** the group's SIMPLE STYLE store and Iris Tech Service appliance-subscription and delivery sites; Iris Plaza says it has not confirmed unauthorized access or a leak on those services.
- **If you shopped there:** change the password anywhere you reused it. Iris Plaza says it will email affected customers and will never ask for a password, PIN or authentication code, or send a link that asks you to type one.

Sources: [Iris Ohyama / Iris Plaza: second report on the EC-site outage and possible personal-data leak (Nov 5, Japanese)](https://www.irisohyama.co.jp/news/2026/?date=1105) · [Iris Plaza second-report PDF (Nov 5, Japanese)](https://www.irisohyama.co.jp/news/2026/1105.pdf) · [Iris Plaza first report (Oct 29, Japanese)](https://www.irisohyama.co.jp/news/2026/?date=1029)