Iris Ohyama Takes Online Store Offline After Cloud Breach Puts 7.7 Million Customer Records at Risk

Iris Ohyama, the Japanese retailer of appliances, furniture and pet supplies, has suspended its Iris Plaza online store after finding a suspicious file on a third-party cloud service. The company disclosed the incident on October 29, a day after the discovery, and later confirmed unauthorised access. No reopening date has been given, orders are shipping more slowly, and some customers wanting to cancel have been told they may need to refuse delivery if the parcel arrives first.

The affected cloud environment held information on roughly 5.8 million registered customers, including former members, plus another 1.9 million people who bought without an account or took part in promotions. Data at risk may include names, addresses, phone numbers, email addresses, dates of birth, gender and passwords, though the exact details vary by customer. Some data, including passwords, was encrypted, but the company has not said what protection was used. Customers who reused their Iris Plaza password elsewhere have been told to change it. The company says payment card details were not stored in the affected service and have not been compromised.

It is still unclear whether attackers actually took any data, and the investigation into the full extent of the intrusion continues. Iris Plaza stores on Rakuten, Yahoo! Shopping and auPAY Market remain open, and the company says it has found no evidence they were affected.