Iris Ohyama data breach may expose personal information of 7.7 million people
Iris Ohyama data breach may expose personal information of 7.7 million people.
Japanese manufacturer Iris Ohyama has reported a data breach affecting approximately 7.7 million customers through an external cloud service used by its online shopping subsidiary, Iris Plaza. The exposed data may include names, addresses, phone numbers, email addresses, gender, dates of birth, and passwords. The company has notified Japanese police and the Personal Information Protection Commission.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Iris Ohyama?
Get an email when a new story names Iris Ohyama, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonIris Ohyama's data breach illustrates the critical risk posed by third-party cloud service providers handling sensitive customer data. The breach originated through an external cloud service used by its online shopping subsidiary, meaning the company's own perimeter controls offered little protection against a vendor-side failure. With 7.7 million records potentially exposed — including passwords and personal identifiers — the blast radius is enormous. This incident underscores that organizations cannot outsource security responsibility alongside their data: rigorous vendor risk management and contractual security obligations are essential when customer data leaves the organization's direct control.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.