Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk
No reopening date as orders face delays and some customers are told to refuse deliveries to cancel purchases
Japanese electronics manufacturer Iris Ohyama has suspended its online store following a cloud security breach that potentially exposed the personal data of 7.7 million customers. The retailer, which sells a wide array of products including home appliances, furniture, and pet supplies, first alerted the public to the issue on October 29, a day after detecting a suspicious file on the cloud service utilized by its Iris Plaza ecommerce platform.
Iris Plaza promptly shut down its website and associated systems, initiating an investigation upon discovering the unauthorized access.
The potentially compromised cloud environment held personal details of around 5.8 million registered customers, comprising both former members and individuals who had made purchases without registering accounts or engaging in promotional activities. The exposed data encompasses names, addresses, phone numbers, email addresses, birth dates, gender, and passwords.
However, Iris Ohyama has not disclosed the exact information at risk for each customer. Some data, including passwords, remained encrypted, but the company has not specified the protective measures employed. Iris Ohyama has advised customers who have reused their Iris Plaza passwords on other platforms to change them ahead of potential unauthorized access.
On the positive side, Iris Ohyama assures that the retailer did not store payment information within the affected cloud service, and thus, customers' credit card details have not been compromised. The extent of the breach remains uncertain, as the company is still investigating whether attackers obtained any personal information.
Iris Plaza's FAQ indicates that the organization continues to probe the possibility of a data leak and has not yet determined the full impact of the intrusion. As of now, Iris Plaza's website remains offline, with no timeline provided for its restoration. Orders are also experiencing delays, and customers attempting to cancel purchases may need to prevent delivery drivers from arriving if their parcels are sent before the cancellation process.
Despite the widespread impact, Iris Plaza's physical stores on online retail platforms such as Rakuten, Yahoo! Shopping, and auPAY Market continue to function without any reported issues. The company has confirmed that it has found no evidence of those stores being affected by the breach. Iris Ohyama has reported the incident to Japanese authorities and intends to notify affected customers individually.
Additionally, the company has issued warnings to shoppers regarding potential phishing emails, fraudulent calls, and fake websites impersonating Iris Ohyama. The full extent of the breach, including whether any of the 7.7 million records left Iris Ohyama's systems, has yet to be identified by the company.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
