Iris Ohyama Says an Intruder May Have Taken Data on 7.7 Million Shoppers, Including People Who Left Years Ago

One of Japan's biggest household goods makers has kept its online store dark for almost two weeks, and it now has a number to explain why. Iris Plaza, which runs Iris Ohyama's official shopping site, says personal data on about 7.7 million people, stored in an outside cloud service, may have been viewed or taken by an intruder, according to its second notice on November 5.

The total splits in two. About 5.8 million are registered members, a figure that includes people who had already closed their accounts. Their records can hold names, addresses, phone numbers, email addresses, gender, dates of birth and passwords. The other 1.9 million bought as guests or entered promotions, and their records hold names, addresses, phone numbers and email addresses. Passwords were encrypted, but the company has not said which method it used. Card numbers were not kept in that cloud service.

Two weeks of shutdowns

Iris Plaza found a suspicious file in the cloud service on October 28 and switched off the store and related systems the same day. It confirmed unauthorized access and reported it to the police and Japan's Personal Information Protection Commission on October 29. It is still working out how many records actually left, and has named neither the cloud provider nor the attacker. As of November 5 it had no reports of misuse or financial loss.

The shutdown reaches beyond the main store. The home furnishings site Simple Style is offline, and Iris Tech Service has stopped taking new orders for its appliance subscriptions and delivery and installation services, even though the company says it found no intrusion there. Iris Plaza shops on outside marketplaces were not affected.

Data that should not have been there

The most uncomfortable detail is who is on the list. People who left Iris Plaza still had their names and addresses sitting in the cloud, as Joho no Todai points out, without knowing it was still kept. Muji faced the same question last week, after it emerged that the retailer had held on to 1.09 million full card numbers from a perks scheme.

Iris Plaza says it will contact affected customers by email and will never ask for a password, PIN or verification code. It warns that fake emails, texts, sites and social accounts posing as the company may follow, and asks anyone who used the same password elsewhere to change it. There is still no date for the store to reopen.

Some offers on this page may be paid placements or contain affiliate links.