Japanese manufacturer Iris Ohyama says personal information belonging to about 7.7 million people may have been exposed after unauthorised access to a third-party cloud service used by its Iris Plaza online shopping platform. The company disclosed the incident on 8 November 2026, in an update to a breach it first reported in late October.

Iris Plaza staff found a suspicious file in the external cloud service on 28 October and immediately suspended the online store and related systems while an investigation began. The company confirmed unauthorised access by a third party and issued its first public notice on 29 October. Further investigation confirmed that customer data stored in the compromised service may have been accessed, although the company has not yet established exactly how many records were taken or how many people are affected.

The potential exposure covers two groups: up to 5.8 million registered and former members, whose data may include names, addresses, telephone numbers, email addresses, gender, passwords and dates of birth, and about 1.9 million non-members, including guest shoppers, whose names, addresses, telephone numbers and email addresses may be involved. Credit card information was not stored in the affected cloud service and was not impacted, BleepingComputer reports.

Iris Ohyama notified Japan's Personal Information Protection Commission and the police on 29 October, and began notifying customers on 5 November. As of 5 November the company had received no reports of misuse of the exposed information or financial loss linked to the incident. Customers should watch for phishing emails and messages that use their real details, and change their Iris Plaza password if they reused it anywhere else.