Japanese online retailer Iris Plaza has warned that a breach of an external cloud service may have exposed personal information relating to approximately 7.7 million people, including customer passwords.
The company has confirmed unauthorized access but is still investigating how many records were actually leaked and how many individuals were affected. As of its November 5 update, it had received no reports of misuse or financial losses linked to the incident.
Iris Plaza discovered suspicious files in a cloud service it uses on October 28, prompting it to shut down its online store and related systems. An investigation subsequently confirmed third-party access, which the company first disclosed on October 29.
Based in Sendai, Japan, Iris Plaza is part of the Iris Group and operates Iris Ohyama’s official online shopping site. The incident has also prompted precautionary shutdowns affecting other shopping and service websites within the group.
Passwords among potentially exposed data
According to the company’s latest announcement, the affected cloud environment held two categories of personal information:
- Approximately 5.8 million registered members, including former members: names, addresses, telephone numbers, email addresses, gender, passwords, dates of birth, and other information.
- Approximately 1.9 million nonmembers, including guest shoppers and campaign participants: names, addresses, telephone numbers, and email addresses.
The fields potentially exposed vary according to what each person registered. Password information is excluded for former members.
Iris Plaza says passwords and some other fields were encrypted, but it has not disclosed the protection methods used.
Credit card information was not stored in the affected cloud service and was not impacted, the company said. It has also found no evidence of related unauthorized access or information leakage at its stores on third-party online marketplaces.
Store shutdown continues
Iris Plaza says it blocked the unauthorized access route and reported the incident to police and Japan’s Personal Information Protection Commission on October 29. It will continue investigating and working toward recovery with relevant authorities and outside specialists.
The retailer has not announced a reopening date. Its Simple Style home furnishings website has also been offline since October 28 as a precaution. Iris Tech Service, another group company, suspended websites and new applications for appliance subscriptions and furniture and appliance delivery and installation services that same day. Neither operation has confirmed unauthorized access or a data leak.
Iris Plaza is beginning customer notifications on November 5, with individual emails and other communications to follow as the investigation progresses.
Customers who reused their Iris Plaza password elsewhere should change it on those services. The company also warns of impersonation emails, text messages, calls, websites, and social media accounts. Legitimate notifications will never request passwords, PINs, authentication codes, or other sensitive information.
Leave a Reply