As detailed in Bleeping Computer, Japanese manufacturer Iris Ohyama recently disclosed a significant data breach involving its Iris Plaza online shopping platform.
The company confirmed that unauthorized actors gained access to a third-party cloud service, potentially exposing the personal information of approximately 7.7 million individuals. The affected group includes 5.8 million registered members and 1.9 million non-members. Compromised data may include full names, physical addresses, phone numbers, email addresses, gender, dates of birth and account passwords. Iris Ohyama stated that passwords for active members were stored in an encrypted format, and credit card information was not held within the compromised cloud environment. Upon discovering a suspicious file on Oct. 28, the firm suspended its online store and related services, including those managed by Iris Tech Service Co., Ltd. The company notified the Personal Information Protection Commission and local police on Oct. 29. As of Nov. 5, there were no reports of data misuse or financial loss. Iris Ohyama continues to investigate the incident and has not identified the perpetrators behind the unauthorized access. This event highlights the ongoing risks associated with third-party cloud service dependencies for major retailers.
Source: Bleeping Computer
