[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwAAhZUe5YugLCCKs4OHVgkJ2eG6BMOneIUXPCUy-L0g":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"af40d205-7917-43b4-8889-5026bac00fea","iris-ohyama-breach-77-million-records-exposed-via-third-party-cloud-service","cd9f71de-154f-4626-9da5-23c98686da5a","Iris Ohyama Breach: 7.7 Million Records Exposed via Third-Party Cloud Service","Iris Ohyama's data breach illustrates the critical risk posed by third-party cloud service providers handling sensitive customer data. The breach originated through an external cloud service used by its online shopping subsidiary, meaning the company's own perimeter controls offered little protection against a vendor-side failure. With 7.7 million records potentially exposed — including passwords and personal identifiers — the blast radius is enormous. This incident underscores that organizations cannot outsource security responsibility alongside their data: rigorous vendor risk management and contractual security obligations are essential when customer data leaves the organization's direct control.","**Immediate actions:**\n- Conduct an emergency audit of all third-party cloud services that store or process customer personal data to assess current exposure.\n- Force-reset all affected customer passwords and notify impacted individuals with clear, actionable guidance.\n- Engage the external cloud provider to obtain full incident details, logs, and confirmation of containment.\n\n**Long-term improvements:**\n- Establish a formal Third-Party Risk Management (TPRM) program requiring security assessments, penetration testing results, and contractual security SLAs for all vendors handling personal data.\n- Enforce data minimization principles so that subsidiaries and vendors only retain the minimum personal data fields necessary for their function.\n- Implement strong encryption for stored personal data and password hashing (e.g., bcrypt\u002FArgon2) as a contractual requirement for all cloud vendors.\n\n**Detection measures:**\n- Require vendors to provide real-time security event logs and integrate them into the organization's centralized SIEM for continuous monitoring.\n- Define and enforce breach notification SLAs in vendor contracts so that incidents are reported to your security team within hours, not days.",[12,13,14,15,16,17,18],"CIS Control 15: Service Provider Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIS2 Article 21(2)(b)","CIS Control 3: Data Protection","CIS Control 17: Incident Response Management",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"CIS Control 3: Data Protection":22,"CIS Control 15: Service Provider Management":23,"CIS Control 17: Incident Response Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Article 32 requires both controllers and processors to implement appropriate technical and organizational measures to protect personal data — a standard that the external cloud service clearly failed to meet, creating regulatory exposure for Iris Ohyama.","NIS2 explicitly mandates supply chain security measures including agreements with direct suppliers and service providers, which would have imposed binding security obligations on the cloud vendor responsible for this breach.","This control requires organizations to inventory sensitive data and enforce protections regardless of where that data resides, including third-party systems — a safeguard that would have ensured encryption and access controls were applied to the 7.7 million customer records.","This control requires organizations to assess, monitor, and manage the security posture of external service providers — directly addressing the risk of a breach originating in a third-party cloud service like the one used by Iris Plaza.","A mature incident response plan with pre-established vendor communication protocols would have accelerated containment and customer notification, reducing harm once the breach in the external cloud service was discovered.","Had the external cloud service been subject to regular vulnerability assessments as required by this control, the security weakness that enabled the breach may have been identified and remediated before exploitation.","Exposed passwords indicate that access credential protection — including strong hashing and vendor-enforced authentication standards — was insufficient, which this control explicitly requires organizations to govern across their supply chain.","published","2026-11-10T08:22:41.753436+00:00","2026-11-10T08:22:41.736+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fsecurityaffairs.com\u002F202740\u002Fdata-breach\u002Firis-ohyama-data-breach-may-expose-personal-information-of-7-7-million-people.html","iris-ohyama-data-breach-may-expose-personal-information-of-7-7-million-people-1b3fe8","Iris Ohyama data breach may expose personal information of 7.7 million people",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":54,"name":55,"problem":56},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":58,"name":59,"problem":60},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]