Japanese Retailer Iris Plaza Discloses Cloud Breach Exposing Data on 7.7 Million Customers

Iris Plaza, the e-commerce arm of Japanese home goods manufacturer Iris Ohyama, has disclosed that an intruder gained unauthorized access to an external cloud service storing personal data on approximately 7.7 million people. The company found suspicious files in the service on October 28 and immediately took its online store and related sites offline, confirming third-party access the following day and notifying Japanese police and the Personal Information Protection Commission.

The breach is notable both for its scale and for what it reveals about a persistent weak point in retail security: third-party cloud infrastructure. Rather than a direct attack on Iris Plaza's own servers, the intrusion ran through an external cloud provider the retailer relies on for parts of its operations — a pattern that has repeatedly turned up in major breaches this year, since attackers often find it easier to compromise a shared vendor than a well-defended primary target.

According to Iris Plaza's November 5 update, the exposed records break down into two groups. About 5.8 million current and former members may have had their names, addresses, phone numbers, email addresses, gender, dates of birth, and passwords exposed, though former members' passwords were excluded. A further 1.9 million non-members — people who made guest purchases or entered promotional campaigns without creating an account — may have had their names, addresses, phone numbers, and email addresses accessed. Iris Plaza says passwords and some other fields were encrypted, though it has not detailed the encryption method, and that credit card numbers were never stored in the affected cloud service.

The company says it has received no reports of misuse or financial loss linked to the incident as of its latest update, and it is still investigating exactly how many records were actually viewed or taken versus merely accessible. It has not named the cloud provider involved, the attacker, or the specific entry point used to gain access. Individual notifications to affected customers are underway, and Iris Plaza is warning shoppers who reused their store password on other services to change it there as well, while cautioning against phishing attempts that impersonate the company.

For a retailer with millions of customers across Japan, a breach of this size carries real regulatory weight — Japan's Personal Information Protection Commission has broad authority to order corrective action and can require public disclosure of how an incident occurred. The incident also lands amid a wider pattern of 2026 retail and e-commerce breaches tied to third-party cloud misconfigurations rather than direct network intrusions, reinforcing that vendor risk management, not just perimeter defense, has become a core part of retail security. Iris Plaza has not announced a reopening date for its online store.

As first reported by CyberInsider, the breach ranks among the largest disclosed by a Japanese retailer in 2026.