Iris Plaza Breach: Unauthorized Access to External Cloud May Have Exposed Personal Data of Approximately 7.7 Million People

On November 5th, Iris Ohyama issued a second report regarding a breach that temporarily suspended the Iris Plaza e-commerce site. The company confirmed unauthorized access to an external cloud service that stored personal data for approximately 7.7 million individuals, including names, addresses, phone numbers, and email addresses. While the total count of accessed records remains unknown, passwords were among the potentially viewed data.

The breach was first discovered on October 28th when suspicious files were detected within the external cloud. Iris Plaza and related systems were promptly suspended, and initial containment measures were put in place. The police and the Personal Information Protection Commission were notified on October 29th, following which further investigations revealed the potential exposure of personal information for up to 7.7 million users.

The exact number of accessed records and specific data items remain under investigation as of November 5th.

The incident highlights the critical importance of safeguarding sensitive data stored in external cloud services. While credit card information was not stored on the affected cloud service, the potential exposure of other personal details underscores the need for robust security measures. Iris Ohyama has taken swift action to investigate the breach, revoke credentials, and advise affected users on password resets.

Continued monitoring of relevant logs and adherence to best practices in identity management and cloud security are essential to mitigate the risk of further unauthorized access and potential secondary damage, such as phishing or password reuse by malicious actors.