Iris Ohyama says data of about 7.7 million people may have been exposed
Iris Ohyama, operator of the Iris Plaza shopping platform, disclosed unauthorized access to a third-party cloud service it used.
Written by a model from the sources below. Verify against them.
- Vendor
- Iris Ohyama
- Product
- Iris Plaza
- Status
- Confirmed
- Disclosed
- Data taken
- About 7.7M records: Names, Home addresses, Phone numbers, Email addresses, Dates of birth, Password hashes
- BleepingComputer: “Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people…”
- Third-party vendor
Summary
The company said personal information of about 7.7 million people may have been exposed.
What to do
Change your password there and anywhere you reused it, and turn on multi-factor authentication
For password hashes (current and former platform members)Expect phishing that uses this breach; verify messages that mention it
For home addresses (5.8 million current and former platform members), phone numbers (5.8 million current and former platform members) and email addresses (5.8 million current and former platform members)Expect scammers to use your birth date to pass identity checks; add a PIN or passphrase with your bank and phone carrier
For dates of birth (5.8 million current and former platform members)Watch for Iris Plaza notices and follow the company's guidance
Change your Iris Plaza account password and any reused passwords
Be wary of unexpected emails or messages that reference Iris Plaza or your orders
Monitor accounts and payment records for suspicious activity
Timeline
- Made public by BleepingComputer
- Confirmed by Iris Ohyama
BleepingComputer: “We confirmed unauthorized access by a third party and disclosed it in our first notice on October 29,”
- First seen by cve.now1 day
- Record last updated
What was taken
About 7.7M records, perBleepingComputer
| Taken | Per the source |
|---|---|
| Names (5.8 million current and former platform members), Home addresses (5.8 million current and former platform members), Phone numbers (5.8 million current and former platform members), Email addresses (5.8 million current and former platform members), Dates of birth (5.8 million current and former platform members), Password hashes (current and former platform members) | SecurityWeek: “Of the 7.7 million individuals potentially affected, 5.8 million are current and former platform members who had their names, addresses, phone numbers, email a…” |
Evidence 10
- PressBleepingComputer
“Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used.”
+1 more: BleepingComputer on Bluesky - Social
- Social
- Social
- SocialMastodon
“Iris Ohyama disclosed a cloud intrusion with potential impact on 7.7 million customers.”
Show all 10 sourcesShow fewer sources
- SocialBluesky
“7.7M affected by an Iris Plaza breach — suspicious file in third-party cloud.”
- SocialMastodon
“Iris Ohyama says data on up to 7.7M people tied to its Iris Plaza store may have leaked from a breached third-party cloud service: names, addresses, emails, birth dates, encrypted passwords.”
- SocialBluesky
“アイリスプラザ、約770万人分の個人情報漏えいか。退会者のデータも対象”
- Socialr/cybersecurity
“Iris Ohyama said on Nov 5 that data on about 7.7 million people may have been exposed after a suspicious file turned up on Oct 28 in an external cloud service used by its Iris Plaza online store.”
- PressSecurityWeek
“Hackers compromised an external cloud service used by the shopping platform and may have stolen personal information from it.”
Corrections
- Changed “Names were exposed” to “Names of 5.8 million current and former platform members were exposed”.
- Changed “Home addresses were exposed” to “Home addresses of 5.8 million current and former platform members were exposed”.
- Changed “Phone numbers were exposed” to “Phone numbers of 5.8 million current and former platform members were exposed”.
- Changed “Email addresses were exposed” to “Email addresses of 5.8 million current and former platform members were exposed”.
- Changed “Dates of birth were exposed” to “Dates of birth of 5.8 million current and former platform members were exposed”.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the Iris Ohyama breach
Was Iris Ohyama breached?
Yes. Iris Ohyama says so: “We confirmed unauthorized access by a third party and disclosed it in our first notice on October 29,” (BleepingComputer).
What data was exposed?
About 7.7M records. Names (5.8 million current and former platform members), Home addresses (5.8 million current and former platform members), Phone numbers (5.8 million current and former platform members), Email addresses (5.8 million current and former platform members), Dates of birth (5.8 million current and former platform members), Password hashes (current and former platform members).
What should Iris Ohyama customers do?
Change your password there and anywhere you reused it, and turn on multi-factor authentication. Expect phishing that uses this breach; verify messages that mention it. Expect scammers to use your birth date to pass identity checks; add a PIN or passphrase with your bank and phone carrier. Watch for Iris Plaza notices and follow the company's guidance. Change your Iris Plaza account password and any reused passwords. Be wary of unexpected emails or messages that reference Iris Plaza or your orders. Monitor accounts and payment records for suspicious activity.