Iris Ohyama Cloud Service Breach Exposes 7.7 Million Iris Plaza Customer Records

Iris Ohyama suspended the Iris Plaza platform after detecting unauthorized access to its third-party cloud environment. The company disconnected affected systems, notified Japanese authorities, and engaged external investigators. No credit card data was stored in the compromised service, and no store systems were impacted. Encrypted passwords were taken but the company has not disclosed the hashing method or salt status. Procurement and incident records show Japanese manufacturers increasingly rely on shared cloud tenants for e-commerce without segmenting customer databases. Similar exposures at other domestic retailers in 2023-2024 followed identical patterns of over-privileged service accounts and delayed detection measured in weeks. The 7.7 million figure aligns with cumulative user growth since platform launch rather than active accounts only. Official statements emphasize blocked access and absence of reported fraud, yet provide no timeline for forensic findings or confirmation that logs were preserved. Independent verification of the access vector remains unavailable. Regulatory notification requirements under Japan’s APPI will likely trigger individual alerts within 60 days, increasing secondary phishing risk. Operational impact includes extended platform downtime and suspension of related services. Expect mandatory regulator reporting and possible class-action exposure if password storage proves inadequate. Monitoring of dark web marketplaces for resale of the dataset should begin immediately.