Japanese homeware manufacturer Iris Ohyama has suspended its Iris Plaza online store after confirming unauthorized access to an external cloud service that may have exposed personal information linked to approximately 7.7 million people. The company discovered suspicious files in the environment on October 28, halted the store and related systems, and reported the intrusion to police and Japan’s Personal Information Protection Commission the following day. Iris Ohyama’s November 5 update says the data may have been viewed or acquired, but the company has not yet determined how many records were actually taken. [16]
The potentially affected data covers about 5.8 million current and former Iris Plaza members and roughly 1.9 million nonmembers, including people who checked out without registering or entered campaigns. Member records may include names, addresses, telephone numbers, email addresses, gender, dates of birth and passwords. Nonmember records may include names, addresses, telephone numbers and email addresses. Iris Ohyama says not every person had every field exposed and that some fields, including passwords, were encrypted; former members’ records do not include passwords. [16]
Credit-card information was not stored in the affected cloud service, the company says, and it has found no evidence so far of unauthorized use or financial loss connected to the incident. The investigation into the access route, the actual number of affected individuals and whether information left the environment remains underway. Iris Ohyama has not attributed the intrusion to a threat actor, identified the cloud provider or disclosed a vulnerability or CVE associated with the incident.
The main Iris Plaza site remains offline while the company works on containment, root-cause analysis and measures intended to prevent a recurrence. Iris Ohyama also stopped the SIMPLE STYLE home-furnishings site and paused new applications for certain subscription and delivery services operated by group companies as a precaution, although it says no unauthorized access or information leakage has been confirmed on those services. Its stores on external e-commerce marketplaces were also reported unaffected at the time of the update. [16]
Iris Ohyama says it will contact potentially affected customers individually. Customers who reused an Iris Plaza password elsewhere should change it immediately and enable multifactor authentication where available. The company is also warning shoppers about phishing emails, text messages, calls, fake websites and social-media accounts: legitimate follow-up messages will not request passwords, PINs, authentication codes or other sensitive information, or ask customers to enter them through links. [16]
