Breach · high
Iris Ohyama cloud breach exposes up to 7.7 million customer records
Tier D · Background noise – Good to know
Who’s exposed: About 7.7 million Iris Plaza customers whose personal data may be exposed
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
Exploited in the wild · Secrets exposed
The Brief
- Iris Ohyama took its Iris Plaza online store offline after discovering unauthorized access to a third-party cloud service it used.
- The company says personal information of about 7.7 million customers may have been exposed.
- Shoppers were unable to place orders while the store was down.
Why it matters
Millions of customers' personal data may be in attackers' hands, which raises phishing and fraud risk for them and shows the risk of third-party cloud services holding customer data.
The checklist behind the tier
Checklist · 2 of 10 yes
| No | Hits tech teams | Retailer Iris Ohyama's homeware and electronics shopping platform; not developer tooling or infrastructure. |
| No | Core infrastructure | A single retailer's shopping platform breach; not widely run core software. |
| No | Popular tool | Iris Plaza is a niche retail platform, not a widely used framework or tool. |
| Yes | Exploited in the wild | BleepingComputer: unauthorized access to a third-party cloud service actually occurred, exposing customer data. |
| No | Public exploit | No source mentions published exploit code or a proof-of-concept. |
| No | Remote, no login | No source says the attack used unauthenticated network access. |
| No | Full takeover | Sources describe data access only; no source reports code execution or admin takeover. |
| Yes | Secrets exposed | BleepingComputer: personal information of about 7.7 million people may have been exposed. |
| No | Supply chain | No source reports malicious code shipped through a trusted package, update or pipeline. |
| No | No fix yet | No source says a fix is missing; the store was taken down pending investigation. |
Timeline
Iris Ohyama disclosed that personal information of about 7.7 million people may have been exposed via unauthorized access to a third-party cloud service
BleepingComputer
Iris Ohyama data cloud breach exposes info of 7.7 million customers
Iris Ohyama took the online store offline after discovering the breach
SecurityWeek
Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
www.theregister.com - Articles
Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk
Security Affairs
Iris Ohyama data breach may expose personal information of 7.7 million people
Full coverage · 4 sources
First seen · 4 sources · Full story page · How tiers are decided