Another huge data breach hits a major Japanese company — Iris Ohyama attack exposes info of 7.7 million customers

Major Japanese company Iris Ohyama has suffered a significant data breach, exposing the information of 7.7 million individuals. The attack compromised its e-commerce platform, Exposed data included personal details and encrypted passwords for some users. The company reported the breach on October 29, 2026, stating that its investigation was ongoing.

Credit card information was not stolen during the attack. Iris Ohyama discovered suspicious files in an external cloud service on October 28, leading to the confirmation of the data theft. The stolen data included details about approximately 5.8 million members and 1.9 million non-members. Member data consisted of names, addresses, phone numbers, email addresses, genders, dates of birth, and encrypted passwords.

Non-member data primarily comprised names, addresses, phone numbers, and email addresses. The fact that passwords were encrypted provides some relief, as it makes them harder to access. However, the company has advised users to update their login credentials. Iris Ohyama has not received any ransom demands or attributed the attack to any specific group.

The company has notified the data protection watchdog agency and local law enforcement authorities. This incident adds to a series of cyberattacks targeting Japanese organizations, including recent attacks on GMO, a Japanese Burger King, and Daiichi Kosho. Iris Ohyama, a large consumer goods manufacturer, reported annual revenue of $1.53 billion and employs over 6,300 people.