According to ITmedia, Iris Plaza announced on November 5 that following unauthorized access to an external cloud service used by the company, personal data of approximately 7.7 million individuals stored there may have been viewed or obtained [2]. According to the report, potentially affected individuals include approximately 5.8 million members (including former members), whose data may include names, addresses, phone numbers, email addresses, gender, encrypted passwords (excluding former members), and dates of birth, as well as approximately 1.9 million non-members whose data may include names, addresses, phone numbers, and email addresses; the actual number of leaked records remains under investigation, while credit card data was not stored in that cloud environment [2]. Cyberinsider cited the company's warning that customers who used the same password as their Iris Plaza account on other services should change it immediately and stay alert for phishing emails, SMS messages, phone calls, or websites impersonating the company, as legitimate notifications will never ask for passwords or verification codes [4].
External Cloud Used by Iris Plaza Online Store Accessed Without Authorization; Personal Data of Approx. 7.7 Million Customers Potentially Exposed
3 min read
- Disclosed
- Oct 29, 2026
- Occurred
- Oct 28, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 9, 2026
- Scale
- 7,700,000 people[2]
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Retail
What to do nowOur advice
Cyberinsider cited the company's warning that customers who used the same password as their Iris Plaza account on other services should change it immediately and stay alert for phishing emails, SMS messages, phone calls, or websites impersonating the company, as legitimate notifications will never ask for passwords or verification codes
Timeline
- Security NEXT publishes report (date only; timestamp is a placeholder)[1]
- Media cites company's second notice: personal data of approx. 7.7 million individuals on external cloud potentially leaked[2][3][4]
ITmedia reported that Iris Plaza announced on November 5, 2026, that following unauthorized access to an external cloud service used by the company, personal data of approximately 7.7 million individuals stored there may have been viewed or obtained, including approximately 5.8 million members and 1.9 million non-members; the actual number of leaked records remains under investigation, and credit card data was not stored in that cloud environment. BleepingComputer also reported on the incident on November 8. Cyberinsider cited the company's reminder that users who reused the same password on other services should change it immediately and remain vigilant against spoofing notifications.
Technical details
What Happened
According to ITmedia, Iris Plaza stated on November 5 that after discovering suspicious files on an external cloud service it uses on October 28, it immediately suspended Iris Plaza and related systems to investigate, confirming unauthorized access by a third party [2].
Following the investigation, the report noted that personal data of approximately 7.7 million individuals stored on the external cloud may have been viewed or obtained, while the actual number of leaked records and affected individuals remains under investigation [2].
BleepingComputer also reported that an Iris Plaza spokesperson stated the company had not received direct contact from the attackers and had not yet attributed the attack [3].
Scope of Impact
ITmedia reported that approximately 5.8 million members (including former members) may have had names, residential addresses, phone numbers, email addresses, gender, encrypted passwords (excluding former members), and dates of birth exposed, while approximately 1.9 million non-members may have had names, residential addresses, phone numbers, and email addresses exposed, though not every customer record contained all of these fields [2].
The same report noted that credit card information was not stored on the cloud environment and was unaffected; stores operated by the company on external e-commerce platforms have shown no confirmed unauthorized access or data leakage, and no reports of fraudulent misuse related to this incident have been received to date [2].
BleepingComputer reported that to prevent further impact, the SIMPLE STYLE website operated by Iris Plaza has been suspended since October 28, and group company Iris Tech Service also suspended its home appliance subscription and furniture/appliance delivery and installation websites and halted new applications on the same day, though neither of those services has shown confirmed unauthorized access or data leakage .
References
Media4
- [1]
“アイリスオーヤマの通信販売サイト「アイリスプラザ」がサイバー攻撃を受けたことがわかった。”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.