Japanese household-goods maker Iris Ohyama, operator of the Iris Plaza online store, says personal information of about 7.7 million people may have been exposed after a third party gained unauthorised access to an external cloud service the store used, according to BleepingComputer (Bill Toulas, 8 Nov 2026), which cites the company's notices of 29 October and 5 November 2026 (machine-translated).

According to BleepingComputer, the company found a suspicious file in the external cloud service, suspended Iris Plaza (SIMPLE STYLE) and related systems on 28 October, and confirmed unauthorised access by a third party in its first notice on 29 October; websites for Iris Tech Service Co., Ltd. services (home appliance subscriptions, furniture and appliance delivery and installation) were also suspended.

The company says it is still determining the number of records exposed; the possible impact covers up to 5.8 million registered and former members and 1.9 million non-members. Data that may have been exposed, varying per person: full names, physical addresses, phone numbers, email addresses, gender, dates of birth and account passwords; the company says passwords for active members are stored encrypted (scheme not stated), no passwords are stored for former members, and credit card information was not stored in the affected cloud service.

As of 5 November the company had no reports of misuse or financial loss. Japan's Personal Information Protection Commission and police were notified on 29 October 2026.

A spokesperson told BleepingComputer the company had received no direct communication from the attacker and had not identified the perpetrators. (source: BleepingComputer, citing Iris Ohyama notices)