Iris Ohyama data cloud breach exposes info of 7.7 million customers

Iris Ohyama has confirmed a data breach exposing 7.7 million customers.

Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used.

The company discovered the incident late last month and publicly disclosed it with limited details, along with an announcement that the site would be temporarily suspended.

In an update earlier this week, the company said it had discovered a suspicious file in an external cloud service used by the Iris Plaza online store.

We confirmed unauthorized access by a third party and disclosed it in our first notice on October 29, [machine translated] the company said.

The investigation confirmed that customer data stored in the compromised external cloud service may have been accessed by unauthorized actors.

Anyone whose data Iris Ohyama held is potentially affected, specifically customers whose records were exposed.

At this scale, even a low per-record risk adds up to a meaningful number of people who now have to actually watch for fraud, not just a statistic.

We immediately suspended Iris Plaza and related systems and began an investigation.

Financial data has a short shelf life for the victim to react -- fraudulent charges can show up within days, not months.

Stolen credentials travel -- attackers routinely test them against unrelated services, which is why the exposure doesn't stop at the breached system's own doors.

While the company is still trying to determine the number of records exposed and how many people are impacted, it notes that the impact extends to up to 5.8 million registered members and former members, and 1.9 million non-members.

The access point here was stolen login credentials, not a technical vulnerability.

Nippon Columbia malware incident exposes 8.6 million karaoke fan records

BleepingComputer has contacted Iris Plaza to learn more about the attack and whether a ransom payment has been demanded.

If you have any relationship with Iris Ohyama, watch for phishing attempts that reference this breach specifically -- stolen data often gets reused this way.

Any reused password from this account is worth changing immediately, especially on other services where the same password might still be active.

A fraud alert on financial statements is worth considering now, since financial data exposure tends to turn into attempted fraud quickly.

Any unsolicited message referencing this breach is worth treating with suspicion, since attackers commonly impersonate the breached company afterward.