[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGdD6qMzArVpf73K47JC2oJNy73JDyhprxT8NifMxWQo":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"19660735-b718-4f4f-8215-86fb4b6d4ccc","Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers","iris-plaza-breach-may-have-exposed-data-of-7-7-million-customers-b475f3","Hackers compromised an external cloud service used by the shopping platform and may have stolen personal information from it. The post Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers appeared first on SecurityWeek.","Japanese online shopping platform Iris Plaza has suffered a data breach, potentially exposing the personal information of 7.7 million individuals. The incident, discovered on October 28, involved hackers compromising an external cloud service used by the platform. While credit card information was not stored on the affected service, names, addresses, phone numbers, email addresses, dates of birth, gender, and encrypted passwords were compromised for registered members, and names, addresses, phone numbers, and email addresses for non-members.","Iris Plaza breach may have exposed personal data of 7.7 million customers.","https:\u002F\u002Fwww.securityweek.com\u002Firis-plaza-breach-may-have-exposed-data-of-7-7-million-customers\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FIris-Plaza.webp","2026-11-09T12:41:27+00:00","2026-11-09T13:00:14.229141+00:00",7,[17,20],{"name":18,"type":19},"Iris Plaza","product",{"name":21,"type":22},"Iris Ohyama","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":44,"vendors":131},[45,73,102],{"slug":46,"name":47,"problem":48,"products":49},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":68,"url":71,"description":72},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":74,"name":75,"problem":76,"products":77},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":103,"name":104,"problem":105,"products":106},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":144},"iris-plaza-cloud-breach-exposes-77-million-customers-via-third-party-service","Iris Plaza Cloud Breach Exposes 7.7 Million Customers via Third-Party Service","The Iris Plaza breach highlights the critical risk posed by third-party cloud services that store or process sensitive customer data. Attackers compromised an external cloud provider used by the platform, gaining access to personal information for millions of registered and non-registered users — data that organizations are ultimately responsible for protecting regardless of where it resides. The exposure of encrypted passwords, dates of birth, and contact details creates compounded risks including credential stuffing and identity fraud. This incident underscores that outsourcing data storage to cloud providers does not transfer accountability for data security, and that vendor security posture must be continuously evaluated.",[137,138,139,140,141,142,143],"CIS Control 15: Service Provider Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIS2 Article 21(2)(b)","CIS Control 3: Data Protection","CIS Control 17: Incident Response Management",{"GDPR Article 32":145,"NIS2 Article 21(2)(b)":146,"CIS Control 3: Data Protection":147,"CIS Control 15: Service Provider Management":148,"CIS Control 17: Incident Response Management":149,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":150,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":151},"Article 32 requires controllers and processors to implement appropriate technical and organizational measures to protect personal data, including when that data is processed by a third-party cloud service on behalf of the controller.","NIS2 explicitly requires organizations to address supply chain security risks, including the security practices of direct suppliers and service providers such as the external cloud platform compromised in this incident.","This control requires organizations to inventory, classify, and protect sensitive data regardless of where it resides, ensuring that customer PII stored in external cloud services is subject to the same protections as on-premises data.","This control requires organizations to establish and maintain an inventory of service providers and assess their security posture, which would have surfaced inadequate protections on the external cloud service before attackers exploited it.","A well-defined incident response plan covering third-party breaches would have enabled faster containment and customer notification after the October 28 discovery, reducing the window of harm for affected individuals.","This control mandates identifying and remediating technical vulnerabilities in systems used by the organization, including those operated by external cloud providers handling organizational data.","Proper access controls governing who and what systems can access customer data stored in third-party cloud environments would have limited the attacker's ability to reach and exfiltrate 7.7 million records."]