- Iris Ohyama discovered unauthorized access on October 28, 2026. NewsBytes said the access involved an external cloud service used by Iris Plaza.
- BleepingComputer reported that about 7.7 million people may have been affected. SecurityWeek said the group included 5.8 million current and former members and 1.9 million non-members.
- Iris Ohyama said there had been no reports of unauthorized use or financial damage at that time.
Iris Ohyama discovered unauthorized access on October 28, 2026, and began investigating possible exposure of customer data. NewsBytes said the access involved an external cloud service used by Iris Plaza, the company’s online shopping platform.
SecurityWeek said the potentially affected population includes 5.8 million current and former platform members and 1.9 million non-members. It said potentially compromised member data included names, addresses, phone numbers, email addresses, dates of birth, gender information and encrypted passwords.
Iris Ohyama said there had been no reports of unauthorized use or financial damage resulting from the incident at that time.
On this page
Iris Ohyama reported the incident to police and Japan’s privacy regulator
Iris Ohyama reported to police and Japan’s Personal Information Protection Commission on October 29. It also said it had disconnected related systems and launched an investigation after discovering the incident.
The company retained external experts to help investigate and said it had blocked the attackers’ access to the service.
Iris Plaza remained offline during the investigation
SecurityWeek said the Iris Plaza platform remained offline while Iris Ohyama investigated the cause and applied remediation measures.
Iris Ohyama advised users who reused their Iris Plaza password on other platforms to change their credentials. It also warned customers not to open attachments, access links or respond to suspicious emails, SMS messages or calls.
Iris Ohyama said it had blocked the attackers’ access, notified law enforcement and relevant authorities, and retained external experts to aid the investigation. SecurityWeek said Iris Plaza remained offline while the company investigated the cause and applied remediation measures.
Iris Ohyama said it would not request passwords, PINs, authentication codes or sensitive information through links in emails or SMS messages.
What to do now
- Change your credentials if you use your Iris Plaza password on other platforms.
FAQ
What happened to Iris Plaza?
Iris Ohyama discovered unauthorized access on October 28, 2026. NewsBytes said the access involved an external cloud service used by Iris Plaza.
How many people may be affected by the Iris Plaza incident?
BleepingComputer reported that about 7.7 million people may have been affected. SecurityWeek said the group included 5.8 million current and former members and 1.9 million non-members.
What Iris Plaza data may have been exposed?
SecurityWeek said potentially compromised member data included names, addresses, phone numbers, email addresses, dates of birth, gender information and encrypted passwords.
Was Iris Plaza data used without authorization?
Iris Ohyama said there had been no reports of unauthorized use or financial damage resulting from the incident at that time.
What should Iris Plaza password users do?
Iris Ohyama advised users who reused their Iris Plaza password on other platforms to change their credentials.
Sources
How we checked this story
| Claim | Source | Status |
|---|---|---|
| SecurityWeek said hackers may have stolen the personal information of 7.7 million people from Japanese online shopping platform Iris Plaza. | SecurityWeek | Attributed |
| Iris Ohyama discovered the incident on October 28 and immediately suspended Iris Plaza, disconnected related systems, and launched an investigation. | Iris Ohyama, via SecurityWeek | Attributed |
| SecurityWeek said the potentially affected population includes 5.8 million current and former platform members and 1.9 million non-members. | SecurityWeek | Attributed |
| SecurityWeek said potentially compromised member data included names, addresses, phone numbers, email addresses, dates of birth, gender information, and encrypted passwords. | SecurityWeek | Attributed |
| Iris Ohyama blocked the attackers’ access, notified law enforcement and relevant authorities, and retained external experts to help investigate. | Iris Ohyama, via SecurityWeek | Attributed |
| Iris Ohyama said there had been no reports of unauthorized use or financial damage resulting from the incident at that time. | Iris Ohyama, via SecurityWeek | Attributed |
| SecurityWeek said the Iris Plaza platform remained offline while Iris Ohyama investigated the cause and applied remediation measures. | SecurityWeek | Attributed |
| The breach involved unauthorized access to an external cloud service used by Iris Plaza, according to NewsBytes. | NewsBytes | Attributed |
| Iris Ohyama said it would not request passwords, PINs, authentication codes, or sensitive information through email or SMS links. | Iris Ohyama, via NewsBytes | Attributed |
| Iris Ohyama had 13,670 employees worldwide as of January 2026, according to NewsBytes. | NewsBytes | Attributed |
| Iris Plaza reported the unauthorized access to police and Japan’s Personal Information Protection Commission on October 29. | Iris Plaza | Confirmed |
| Iris Plaza advised customers who reused the same password on other services to change it to prevent unauthorized use. | Iris Plaza | Confirmed |
| Iris Plaza warned customers not to open attachments, access links, or respond to suspicious emails, SMS messages, or calls. | Iris Plaza | Confirmed |
| BleepingComputer reported that Iris Ohyama disclosed possible exposure of personal information belonging to about 7.7 million people. | BleepingComputer | Attributed |
| irisohyama.co.jp published its report on Nov 5, 2026. | irisohyama.co.jp | Confirmed |
Could not verify
- Whether the exposed data was actually accessed or downloaded is not established.
- Whether the full 7.7 million people were affected is not established.
- The attackers’ identity and motive are not established.
Related stories
Data LeaksAt least a dozen AI developer platforms hit in attacks seeking AI access tokens
Data LeaksArara email service breach exposed more than 1 million Osaka addresses
Data LeaksMaersk data extraction from acquired legacy system under investigation