Iris Ohyama, the Japanese household-goods manufacturer, says personal information about roughly 7.7 million people may have been exposed after someone gained unauthorized access to an external cloud service used by its online store, Iris Plaza. In a notice dated November 5, Iris Plaza, the group company that runs the store, says it found a suspicious file in that cloud service on October 28, immediately shut down Iris Plaza and related systems, and confirmed third-party access, which it first announced on October 29. It reported the incident to the police and to Japan’s Personal Information Protection Commission on October 29.
The company’s table breaks the number down as about 5.8 million member records (including former members) and about 1.9 million non-member records, such as people who bought something without registering or entered a campaign. For members, the possibly exposed fields are names, addresses, phone numbers, email addresses, gender, passwords, dates of birth and similar details; for non-members, names, addresses, phone numbers and email addresses. Not every person had every field exposed, and former members have no password on file. The company says some items, including passwords, are stored encrypted; BleepingComputer notes it did not say which scheme is used. The company also says credit card data was not stored in the affected cloud service and that, as of November 5, it had received no reports of misuse or financial loss. It says it has not confirmed unauthorized access or leaks at its stores on other online marketplaces. Iris Plaza has also suspended its SIMPLE STYLE home-fashion store, plus the home-appliance subscription and delivery-and-installation sites run by sister company Iris Tech Service, where it has not found unauthorized access. The company has not said when the sites will return. It told BleepingComputer it has had no direct contact from the attacker and has not identified who is responsible; the company said the actual number of affected people is still under investigation.
How to check if you’re affected
Affected products are accounts and past orders on the Iris Plaza online store (the Iris Ohyama official shop in Japan), including closed accounts and purchases or campaign entries made without an account. The company says it will notify people who may be affected individually by email as its investigation progresses, so there is no public lookup tool.
- If you have an Iris Plaza account and used the same password anywhere else, the company asks you to change it on those other services.
- The company warns that fake emails, SMS messages, phone calls, look-alike websites and social media accounts impersonating Iris Plaza or authorities may appear. It asks people not to open attachments or follow links in unexpected messages. It says its own notices will never ask you for a password, PIN, authentication code or other important information, or ask you to enter them on a linked page.
- Questions can go to the Iris Plaza contact center (0120-108-824 in Japan, weekdays and Saturdays 9:30 to 17:00), its FAQ, or plaza_info@irisplaza.co.jp, all as listed in the company’s November 5 notice.