Iris Ohyama cloud breach may expose data of up to 7.7 million Iris Plaza shoppers (2026)

On 8 November 2026, Iris Ohyama — the Sendai-based Japanese manufacturer and retailer of home appliances and household goods — was reported to have suffered a data breach affecting up to 7.7 million people through its Iris Plaza online store. The company discovered a suspicious file in a third-party cloud service used by Iris Plaza, confirmed that an outside party had gained unauthorised access, and suspended the store and related systems as a precaution on 28 October. It notified Japan's Personal Information Protection Commission and the police the following day.

What was exposed

The affected cloud service held customer records that may include full names, physical addresses, phone numbers, email addresses, gender and dates of birth, along with account passwords for some users. Iris Ohyama estimates the breach touches roughly 5.8 million registered and former members of the Iris Plaza store and an additional 1.9 million non-members, for a potential total of up to 7.7 million people, though it stresses that the exact figures are still being confirmed. Passwords for active registered members were stored in encrypted form, no passwords were held for former members, and no credit card information was kept in the affected service.

Why it matters

Even without payment-card data, the combination of names, contact details and dates of birth is more than enough to power targeted phishing and social-engineering campaigns against a very large customer base. Iris Ohyama has not identified the perpetrators and says it has received no direct communication from them. As of 5 November it had seen no reports of the exposed information being misused or of financial losses tied to the breach, and its investigation remained ongoing.

The company urged customers to stay alert to suspicious emails and messages, and advised anyone who had reused their Iris Plaza password on other services to change those credentials immediately.