Iris Plaza breach risks 7.7 million people's data | Magica
Iris Plaza cloud intrusion puts data on 7.7 million people at risk
Editorial Team
••📖4 min read
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
The affected cloud service held data on approximately 7.7 million people; the number whose information was actually leaked remains unknown.
Former members, guest buyers and campaign entrants are among those potentially affected.
The official shopping site remains suspended, while Iris Plaza's stores on external marketplaces continue trading.
Japan's Iris Plaza, the Iris Group retailer that operates household-products and appliance maker Iris Ohyama's official online store, says an intrusion into an external cloud service may have exposed personal information on approximately 7.7 million people. Its November 5 disclosure covers both account holders and people who bought products or entered promotions without registering.
The incident has also disrupted shopping and order handling. The official store remained offline in November 9 reporting, with no reopening date announced. But neither the shutdown nor the population whose data was stored establishes how much information attackers obtained.
Company-reported figures put approximately 5.8 million current and former members and 1.9 million non-members in the affected service. Actual leakage remains under investigation. Chart: Magica. Source: Iris Ohyama.
What the 7.7 million figure measures
In that notice, Iris Plaza says the affected service stored data on approximately 5.8 million current and former members and 1.9 million non-members. It is still investigating the actual number of leaked records and people affected.
Group
People whose data was stored
Information potentially exposed
Current and former members
Approximately 5.8 million
Names, addresses, phone numbers, email addresses, gender, dates of birth and passwords, among other fields; former members' passwords are excluded
Non-members, including guest buyers and campaign entrants
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
Editorial Team
Approximately 1.9 million
Names, addresses, phone numbers and email addresses
Non-members account for roughly a quarter of the total, calculated from the company's rounded figures. The potentially affected population therefore extends beyond people who currently have an account. The company says the fields involved vary with each person's registration details.
Passwords and some other fields were encrypted, Iris Plaza says. A November 9 report notes that the company has not explained what protection was used, leaving the security of any obtained credentials unresolved.
Credit card information was not stored in the affected cloud service and was unaffected by the intrusion, the company says. As of its November 5 notice, it had confirmed no reports of resulting unauthorized use or financial damage. That does not resolve whether other personal information was viewed or taken.
The incident was discovered on October 28, 2026, and first publicly disclosed the following day. Chart: Magica. Source: SecurityWeek.
A precautionary shutdown across related services
Iris Plaza says it discovered a suspicious file in the external cloud service on October 28, immediately suspended its shopping site and related systems, and subsequently confirmed unauthorized access. It first disclosed the incident on October 29. The company says its initial response included blocking the access route and that it reported the incident to police and Japan's Personal Information Protection Commission on October 29.
The shutdown also reached Simple Style, Iris Plaza's home-furnishings store, and appliance-subscription and furniture-and-appliance delivery and installation service sites run by Iris Group company Iris Tech Service. Those sites closed on October 28 as a precaution; Iris Tech Service also stopped accepting new applications. The company said it had found no unauthorized access or information leakage involving those services as of November 5.
Iris Plaza's stores on Rakuten, Yahoo! Shopping and au PAY Market continued operating normally, a report on the operational impact says. The company said it had found no related intrusion or leak at its external-marketplace stores. Customers therefore retained alternative channels to buy from the retailer.
The same report relays the company's guidance that existing orders were being prepared for shipment, although some could be delayed. It said customers would receive an email or other notification when preparations were complete. Customers seeking cancellation were directed to contact support and, if a parcel arrived before cancellation was completed, refuse delivery.
What customers need before the store reopens
Iris Plaza says it will announce a reopening date after identifying the cause and implementing measures to prevent recurrence. It plans to investigate with relevant authorities and outside specialists and contact potentially affected customers individually by email or other means as findings become available.
In the meantime, the company asks customers to change passwords reused on other services and watch for impersonation through email, SMS, telephone calls, websites and social accounts. It says its notifications will not ask for passwords, PINs, authentication codes or other important information, including through links in messages.
The next substantive disclosure needs to distinguish information merely stored in the affected environment from information actually accessed or taken. The November 9 reporting also leaves the cloud provider and intrusion method unidentified. Those findings would clarify both who was affected and what failed; a reopening date alone would not answer those questions.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.
