Japanese household goods maker Iris Ohyama has warned that personal information belonging to as many as 7.7 million people may have been exposed after hackers gained unauthorised access to an external cloud service used by its Iris Plaza online shopping platform. Iris Ohyama is a Japanese consumer goods manufacturer employing about 13,670 people worldwide as of January 2026, with manufacturing facilities in North America, Europe and Asia.

The company discovered the incident on 28 October, when staff found a suspicious file in the cloud environment behind the store. Iris Plaza was suspended the same day, along with related systems, and an investigation began. The company notified Japanese police and the country's Personal Information Protection Commission on 29 October.

Who is affected

In a detailed notice published on 5 November, Iris Ohyama said the data held in the affected service covered about 5.8 million registered and former members of Iris Plaza, plus a further 1.9 million people who had shopped as guests or taken part in promotional campaigns without creating accounts.

For members, the data that may have been exposed includes names, home addresses, phone numbers, email addresses, dates of birth, gender information and account passwords, which the company says were stored encrypted. For non-members, the data includes names, addresses, phone numbers and email addresses.

One important reassurance: credit card information was not stored in the affected cloud service, so payment card details were not caught up in the incident. No Iris Plaza physical store was affected.

What is still unknown

The 7.7 million figure is the outer bound, not a confirmed count of stolen records. The company has not established how many records the attackers actually viewed or obtained, and the investigation into the cause of the incident is still under way.

As of the 5 November notice, Iris Ohyama had received no reports of the data being misused and no reports of financial loss linked to the breach. The company says it has blocked the attackers' access to the service, brought in outside experts to help with the investigation, and begun notifying affected customers by email.

Iris Plaza remains offline while security improvements and recovery work continue, and the company has not announced a date for reopening. Customers who used the platform should watch for official messages from Iris Ohyama and, as a precaution, change their Iris Plaza password and be alert to phishing messages that may try to exploit the breach.