Excerpt from BleepingComputer, Published on November 8, 2026
The Iris Ohyama data breach has raised cybersecurity concerns after the Japanese manufacturer disclosed unauthorised access to an external cloud environment connected to its online shopping platform, Iris Plaza. The incident potentially exposed sensitive customer information, including personal contact details and encrypted passwords, highlighting security risks associated with cloud-based e-commerce infrastructure.
The Iris Ohyama data breach came to light on October 28, 2026, when the company discovered a suspicious file in an external cloud environment used by its Iris Plaza e-commerce platform. An internal investigation confirmed unauthorised access by a third party, prompting the company to suspend affected online services while examining the extent of the incident.According to the company’s disclosure, the affected environment contained information belonging to registered members, former members, and non-registered customers. The potentially exposed information included names, residential addresses, telephone numbers, email addresses, gender, dates of birth, and encrypted passwords belonging to certain registered members.
The exposure raised concerns about possible misuse of customer information, particularly where contact details and other personal records could be exploited for phishing or identity-related fraud. However, the company stated that credit card information was not stored in the affected cloud environment and was therefore not exposed through this incident. Following the discovery, Iris Ohyama blocked the unauthorised access route, suspended affected services, and initiated a detailed investigation into the security incident. The company also notified relevant authorities and advised customers to change passwords that they may have reused across other online services.
As of its November 5 disclosure, the company had not received reports of fraudulent transactions or financial losses linked to the incident. The investigation continued, with the exact number of individuals whose information was accessed or extracted remaining unconfirmed.
For additional information, read the full report from BleepingComputer.
