Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk
Japanese retailer Iris Ohyama takes down online store after cloud breach exposes 7.7M customer records.
Japanese homeware giant Iris Ohyama has taken its online store offline after a cloud breach potentially exposed the personal information of 7.7 million customers. The incident, discovered on October 29, involved unauthorized access to a third-party cloud service used for its Iris Plaza e-commerce operation. While payment information was not stored in the affected service, exposed data may include names, addresses, phone numbers, email addresses, dates of birth, and passwords.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Iris Ohyama?
Get an email when a new story names Iris Ohyama, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonIris Ohyama's breach stemmed from unauthorized access to a third-party cloud service, highlighting the inherent risks of delegating data handling to external vendors without adequate oversight. When customer data — including passwords and personal identifiers — is stored with a third party, the organization's security posture is only as strong as that vendor's. The exposure of 7.7 million records demonstrates that supply chain and cloud vendor risks must be treated with the same rigor as internal systems. Password exposure in particular compounds the harm, as customers frequently reuse credentials across services, amplifying the blast radius far beyond this single incident.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.