Japanese online retailer Iris Plaza has warned that a breach of an external cloud service may have exposed personal information relating to approximately 7.7 million people, including customer passwords. The company, which runs the official online store of home-goods maker Iris Ohyama, found suspicious files in a cloud service it uses on 28 October and shut down its online store while it investigates.

According to the company's latest update, the affected cloud environment held two groups of personal data. Around 5.8 million registered members, including former members, had names, addresses, telephone numbers, email addresses, gender, passwords and dates of birth stored there. A further 1.9 million non-members, including guest shoppers and campaign participants, had names, addresses, telephone numbers and email addresses held in the same environment.

Scale still being established

The company has confirmed unauthorised access, but says it is still investigating how many records were actually leaked. The 7.7 million figure is the number of people whose details were held in the affected system, not a confirmed count of stolen records. Iris Plaza first disclosed the incident on 29 October, the same day it reported the matter to police and to Japan's Personal Information Protection Commission, and it began notifying customers on 5 November.

As of its 5 November update, the company said it had received no reports of misuse or financial losses linked to the incident, and no credit card information has been reported as leaked. The online store remains suspended, with no reopening date announced. Customers have been advised to watch for suspicious emails and to check card statements. The incident follows a string of large Japanese retail breaches disclosed in recent days. Full details are in the report on Cyber Insider, with background from Japanese reporting summarised at SmartScope.