Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk

Your personal data, including passwords, may be at risk if you have shopped with Iris Plaza.

Japanese homeware giant Iris Ohyama has taken its online store offline following a cloud security breach that may have exposed the personal data of up to 7.7 million customers. The incident was discovered on October 29, when suspicious activity was found on a third-party cloud service used by its Iris Plaza e-commerce operation. The company immediately suspended its website and began an investigation, which confirmed unauthorized access. The affected cloud environment potentially holds data for approximately 5.8 million registered customers and 1.9 million non-registered individuals who made purchases or participated in promotions. The exposed information could include names, addresses, phone numbers, email addresses, dates of birth, gender, and encrypted passwords. Iris Ohyama has stated that payment information was not stored in the compromised service and thus was not affected. The duration of the website's downtime and the exact extent of data exfiltration are still under investigation, with no reopening date announced.

This incident highlights the ongoing risks associated with third-party cloud service providers and the potential for widespread data compromise, even when specific payment data is not directly targeted. The fact that a major homeware retailer, dealing with a vast amount of customer information, experienced such a significant breach underscores the need for rigorous security audits and robust encryption practices across all digital touchpoints. The delay in reopening the online store and the current inability for some customers to cancel orders suggest potential operational and customer service disruptions that can persist long after the initial breach is discovered.

The ongoing investigation into the full extent of the intrusion and data leak, coupled with Iris Ohyama's lack of clarity on the encryption methods used for passwords, signals a critical need for greater transparency and accountability from companies regarding their data security measures. Customers are left to proactively change passwords on other services where they may have reused credentials, a burden that could be mitigated with more robust security practices by the breached entity. The company's reliance on third-party cloud services also raises questions about vendor risk management and the due diligence required to protect customer data in a cloud-first environment.