Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
Iris Plaza breach may have exposed personal data of 7.7 million customers.
Japanese online shopping platform Iris Plaza has suffered a data breach, potentially exposing the personal information of 7.7 million individuals. The incident, discovered on October 28, involved hackers compromising an external cloud service used by the platform. While credit card information was not stored on the affected service, names, addresses, phone numbers, email addresses, dates of birth, gender, and encrypted passwords were compromised for registered members, and names, addresses, phone numbers, and email addresses for non-members.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Iris Ohyama?
Get an email when a new story names Iris Ohyama, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Iris Plaza breach highlights the critical risk posed by third-party cloud services that store or process sensitive customer data. Attackers compromised an external cloud provider used by the platform, gaining access to personal information for millions of registered and non-registered users — data that organizations are ultimately responsible for protecting regardless of where it resides. The exposure of encrypted passwords, dates of birth, and contact details creates compounded risks including credential stuffing and identity fraud. This incident underscores that outsourcing data storage to cloud providers does not transfer accountability for data security, and that vendor security posture must be continuously evaluated.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.