Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk
No reopening date as orders face delays and some customers are told to refuse deliveries to cancel purchases
Japanese electronics giant Iris Ohyama has taken down its online store amidst concerns over a potential data breach that may have exposed the personal information of 7.7 million customers. The retailer, which sells a range of products including home appliances, furniture, and pet supplies, first notified the public on October 29, one day after detecting a suspicious file on a third-party cloud service utilized by its Iris Plaza ecommerce operation.
Iris Plaza swiftly suspended its website and associated systems, initiating a thorough investigation. The company has since confirmed unauthorized access to the cloud environment, which allegedly contained personal data of around 5.8 million registered customers and an additional 1.9 million individuals who had made purchases without creating an account or participating in promotional campaigns.
The exposed information includes names, addresses, phone numbers, email addresses, dates of birth, gender, and passwords, though the exact details compromised vary among customers. While some data, such as passwords, was encrypted, Iris Ohyama has not disclosed the protective measures employed. The retailer has advised customers who have reused their Iris Plaza passwords elsewhere to change them proactively.
On the brighter side, Iris Ohyama asserts that it did not store payment information in the affected cloud service, and thus it remains unbreached. The extent of the intrusion is still uncertain, with the company still probing whether any personal information was actually stolen by the attackers. Iris Plaza's website remains offline, and the company is unclear when it will resume operations.
Orders are currently experiencing delays, and customers attempting to cancel purchases may need to prevent delivery drivers from making attempts if their parcels arrive before the cancellation is processed. However, Iris Ohyama's physical stores on Rakuten, Yahoo! Shopping, and auPAY Market remain unaffected. The company has reported the incident to Japanese authorities and intends to notify affected customers individually.
Additionally, Iris Ohyama has cautioned shoppers against falling victim to phishing emails, fraudulent calls, and fake websites mimicking the retailer. The company has yet to identify the responsible cloud provider, determine how the attackers infiltrated the system, or ascertain whether any of the 7.7 million records actually left its systems.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
