[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbnIsFB1Qyv-Ygzb11JjMTLXb9XNgAbTT51uHAy931Yw":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"cd9f71de-154f-4626-9da5-23c98686da5a","Iris Ohyama data breach may expose personal information of 7.7 million people","iris-ohyama-data-breach-may-expose-personal-information-of-7-7-million-people-1b3fe8","Iris Ohyama warns that a cloud data breach may have exposed personal information of 7.7 million customers, including names and passwords. Japanese household goods manufacturer Iris Ohyama has disclosed that attackers may have accessed personal information belonging to approximately 7.7 million people through an external cloud service used by its online shopping subsidiary, Iris Plaza. […]","Japanese manufacturer Iris Ohyama has reported a data breach affecting approximately 7.7 million customers through an external cloud service used by its online shopping subsidiary, Iris Plaza. The exposed data may include names, addresses, phone numbers, email addresses, gender, dates of birth, and passwords. The company has notified Japanese police and the Personal Information Protection Commission.","Iris Ohyama data breach may expose personal information of 7.7 million people.","https:\u002F\u002Fsecurityaffairs.com\u002F202740\u002Fdata-breach\u002Firis-ohyama-data-breach-may-expose-personal-information-of-7-7-million-people.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-17.png","2026-11-10T06:28:06+00:00","2026-11-10T08:00:21.019829+00:00",7,[17,20],{"name":18,"type":19},"Iris Ohyama","vendor",{"name":21,"type":22},"Iris Plaza","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":44,"vendors":132},[45,74,103],{"slug":46,"name":47,"problem":48,"products":49},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"slug":75,"name":76,"problem":77,"products":78},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"slug":104,"name":105,"problem":106,"products":107},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":145},"iris-ohyama-breach-77-million-records-exposed-via-third-party-cloud-service","Iris Ohyama Breach: 7.7 Million Records Exposed via Third-Party Cloud Service","Iris Ohyama's data breach illustrates the critical risk posed by third-party cloud service providers handling sensitive customer data. The breach originated through an external cloud service used by its online shopping subsidiary, meaning the company's own perimeter controls offered little protection against a vendor-side failure. With 7.7 million records potentially exposed — including passwords and personal identifiers — the blast radius is enormous. This incident underscores that organizations cannot outsource security responsibility alongside their data: rigorous vendor risk management and contractual security obligations are essential when customer data leaves the organization's direct control.",[138,139,140,141,142,143,144],"CIS Control 15: Service Provider Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIS2 Article 21(2)(b)","CIS Control 3: Data Protection","CIS Control 17: Incident Response Management",{"GDPR Article 32":146,"NIS2 Article 21(2)(b)":147,"CIS Control 3: Data Protection":148,"CIS Control 15: Service Provider Management":149,"CIS Control 17: Incident Response Management":150,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":151,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":152},"Article 32 requires both controllers and processors to implement appropriate technical and organizational measures to protect personal data — a standard that the external cloud service clearly failed to meet, creating regulatory exposure for Iris Ohyama.","NIS2 explicitly mandates supply chain security measures including agreements with direct suppliers and service providers, which would have imposed binding security obligations on the cloud vendor responsible for this breach.","This control requires organizations to inventory sensitive data and enforce protections regardless of where that data resides, including third-party systems — a safeguard that would have ensured encryption and access controls were applied to the 7.7 million customer records.","This control requires organizations to assess, monitor, and manage the security posture of external service providers — directly addressing the risk of a breach originating in a third-party cloud service like the one used by Iris Plaza.","A mature incident response plan with pre-established vendor communication protocols would have accelerated containment and customer notification, reducing harm once the breach in the external cloud service was discovered.","Had the external cloud service been subject to regular vulnerability assessments as required by this control, the security weakness that enabled the breach may have been identified and remediated before exploitation.","Exposed passwords indicate that access credential protection — including strong hashing and vendor-enforced authentication standards — was insufficient, which this control explicitly requires organizations to govern across their supply chain."]