A Suspicious File. 7.7 Million Shoppers Exposed.

A suspicious file in a cloud service. A store shut down the same day. And now as many as 7.7 million people may have had their personal information exposed. Japanese manufacturer Iris Ohyama, which runs the Iris Plaza shopping platform, disclosed this week that unauthorized access to a third-party cloud service it used may have exposed the personal data of about 7.7 million people.

The company found a suspicious file in an external cloud service used by the Iris Plaza online store on October 28. It suspended Iris Plaza and related systems immediately and began an investigation. “We confirmed unauthorized access by a third party and disclosed it in our first notice on October 29,” the company said. Japan’s Personal Information Protection Commission and police were notified the same day.

The investigation has confirmed that customer data stored in the compromised external cloud service may have been accessed. The company is still trying to determine exactly how many records were exposed, but the impact extends to up to 5.8 million registered members and former members, and 1.9 million non-members who bought products without creating accounts or entered campaigns.

What may have been exposed

According to the company’s notification, the following information may have been exposed: full names, physical addresses, phone numbers, email addresses, gender, dates of birth, and account passwords. The exposed data types vary per person — no passwords are stored for former members, for example. Iris Plaza said it stores passwords for active registered members in encrypted form, though it did not say which encryption scheme it uses.

Two things limit the damage. Credit card information was not stored in the affected cloud service, so payment card theft is off the table. And as of November 5, Iris Plaza had received no reports of misuse of the exposed information or financial loss tied to the incident.

What the company has not said is just as important. It has not named the external cloud provider hosting the compromised service, nor detailed how the suspicious file got there. It told BleepingComputer it received no direct communications from the attacker and has not identified the perpetrators. Whether a ransom was demanded is unknown.

The store stayed dark

The shutdown went beyond Iris Plaza itself. The company’s online store (SIMPLE STYLE) and related systems were suspended on October 28, along with websites for Iris Tech Service, including home appliance subscriptions and furniture and appliance delivery and installation. Iris Ohyama is a major Japanese manufacturer of household products — storage units, LED lighting, home appliances, garden accessories — and Iris Plaza is its online storefront.

The pattern is one security teams keep seeing: the breach did not start in the company’s own systems. It started in a service somebody else ran. A French bank lost $133 million the same way — the attacker came in through a service provider’s platform, not the bank’s own front door. And when an aid agency’s portal was breached, it was the data of more than 20,000 users that ended up exposed. Third-party systems are part of your attack surface whether you treat them that way or not.

What to do now

• If you shopped at Iris Plaza, change that password — and anywhere else you reused it. Even encrypted passwords can be cracked offline, so treat the old one as burned. If the same password protects another account, change that one too, starting with email and banking.
• Turn on multi-factor authentication wherever it is offered. A stolen password alone should not be enough to get into an account. The extra code at sign-in is the cheapest defense against a leak like this one.
• Watch for phishing that uses your real details. Names, addresses, phone numbers, and birth dates make fake messages far more convincing. Be skeptical of any message about Iris Plaza, refunds, or account resets — go to the site yourself instead of clicking a link.
• Audit the cloud services your business depends on. Know which outside services hold your customers’ data, what they store, and how they protect it. A vendor’s breach is your breach the moment your customers’ records are in their system.

As of November 5, no misuse had been reported — but absence of reports is not absence of risk. The data is out there, the attacker is unknown, and the exact number of people affected is still being determined. For 7.7 million shoppers, the safe move is to act as if the data was taken, because the company itself cannot yet say it was not.