Iris Plaza: personal details of up to about 7.7 million shoppers may have been taken

Iris Plaza, the online store run by Japanese manufacturer Iris Ohyama, says personal information belonging to up to about 7.7 million people may have been viewed or taken from a third-party cloud service the company used. The firm published a second notice on November 5, 2026, after suspending the site on October 28. Coverage of that notice continued through November 9.

What happened

According to Iris Ohyama’s November 5 notice (in Japanese), staff found a suspicious file in an external cloud service on October 28. The company suspended Iris Plaza and related systems the same day, confirmed unauthorized access, and published a first notice on October 29. Follow-up work showed that data kept in that cloud service may have been viewed or taken. The company says the stored personal data covers about 7.7 million people in total. It is still working out how many records were actually reached.

SecurityWeek reported on November 9 that the company has blocked the attackers’ access, notified police and Japan’s Personal Information Protection Commission, and hired outside specialists. Iris Plaza remains offline while the firm investigates and repairs.

What may have been exposed

As of the November 5 notice:

• About 5.8 million current and former members: name, address, phone number, email address, gender, date of birth and encrypted passwords (former members do not have password data in the set, the company says).
• About 1.9 million non-members: people who bought without registering, or entered campaigns: name, address, phone number and email address.

Not every field applies to every person. The company says credit card details were not stored in the affected cloud service, and that its shops on other marketplaces show no sign of the same access so far. It also says it has not received reports of misuse or financial loss tied to this incident.

Iris Plaza’s Simple Style store and some Iris Tech Service subscription and delivery sites were paused as a precaution. The company says those services show no confirmed intrusion of their own.

What this means for you

If you shopped on Iris Plaza, someone who has your name, address and email can make a fake “account recovery,” refund or delivery message look real. Encrypted passwords still mean you should stop reusing that password elsewhere. Cards should be unaffected according to the company, but a convincing phishing call does not need a card number.

What you can do

1. Watch for Iris Plaza’s individual email notice. The company says it will contact people whose data may have been reached. It says it will never ask for a password, PIN or verification code, and will not put those fields on a link in a message.
2. If you reused your Iris Plaza password anywhere else, change it on those services, typing the address yourself.
3. Treat unexpected emails, texts or calls about this incident as suspect, even if they use your real name or order details. Do not open attachments or tap links.
4. Call the Iris Plaza contact centre at 0120-108-824 (weekdays and Saturdays, 9:30 a.m. to 5:00 p.m. local time, holidays excepted) or email plaza_info@irisplaza.co.jp if you have questions.
5. See how scammers use leaked data to make phishing personal if a message already seems to know your details.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each shop its own address, so a fake store message that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.

Related coverage

• Nitori: personal details of up to about 37.62 million customers may have been taken: another large Japanese retail disclosure the same day.

• MUJI now says full card numbers of about 1.09 million MUJI Card holders may have been reached: another large Japanese retail disclosure this month.

• How scammers use leaked data to make phishing personal: why a name, address and email make a fake refund call harder to dismiss.

Sources

• Iris Ohyama / Iris Plaza, Second notice: temporary suspension of the Iris Plaza EC site and possible personal data leak from an external cloud service (in Japanese), November 5, 2026
• Iris Ohyama / Iris Plaza, First notice: temporary suspension of the Iris Plaza EC site (in Japanese), October 29, 2026
• SecurityWeek, Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers, November 9, 2026