Abstract:
Iris Ohyama, a well-known Japanese home appliance and household products manufacturer, recently disclosed a major data security incident. The company's official online mall, Iris Plaza, suffered a cyber attack. The attacker illegally accessed the third-party cloud service used by the company, resulting in the personal information of about 7.7 million users being potentially stolen or viewed. Currently, the company has suspended relevant websites and some related services, and is investigating the specific impact of the incident.
Alice Oyama discovered an anomaly on October 28, 2026. At that time, the staff discovered a suspicious file in the external cloud storage service used by the company, and immediately shut down the Iris Plaza online mall and related systems and began an investigation. On October 29, the company confirmed that illegal access by a third party had occurred and reported it to the Japanese police and the Personal Information Protection Commission.
On November 5, the company issued a second announcement, further disclosing the scale of data that may be affected. According to the information currently available, the total amount of personal information involved is approximately 7.7 million people, including approximately 5.8 million current and previously registered members, and approximately 1.9 million non-member users. The latter mainly include consumers who purchase goods directly without registering an account, as well as people who have participated in company promotions and sweepstakes.
The information that may be leaked varies depending on the user's identity. For registered members, the data involved includes name, address, phone number, email address, gender, date of birth, account password, etc. For non-member users, the information that may be affected mainly includes name, address, phone number and email address.
It is worth noting that users who have canceled their accounts may also be affected, but the company stated that the data of canceled members does not contain password information. For the passwords and some other information that are still retained, the company has previously used encryption to store it, but it has not yet disclosed the specific encryption algorithms and protection measures in detail.
One relatively reassuring aspect of this incident is that credit card information was not compromised. Alice Oyama said that credit card information was not originally stored in the third-party cloud service that was illegally accessed this time, and therefore did not fall within the potential leakage scope of this incident. As of November 5, the company has not received reports of fund losses or account theft directly related to this incident.
The attack also caused Alice Oyama to suspend other parts of its online business. In addition to the official shopping website Iris Plaza, the website of SIMPLE STYLE, the company's home fashion brand, also ceased operations on October 28. In addition, the home appliance subscription service operated by the group's affiliated company Iris Tech Service, as well as the furniture and home appliance delivery and installation service website, have also temporarily stopped accepting new applications.
The company emphasized that it has not found any illegal access or data leakage in the above-mentioned related services, but in order to prevent the incident from expanding, it still decided to temporarily shut down the relevant systems. As for when operations will resume, there is currently no timetable.
On the other hand, Alice Oyama’s official stores opened on third-party e-commerce platforms such as Rakuten Market, Yahoo! Shopping and au PAY Market in Japan have not found any abnormalities related to this incident and can still operate normally. For goods that have been ordered through Iris Plaza, the company said it will continue to arrange shipments, but some orders may be delayed.
Currently, investigators have not confirmed the identity of the attacker, nor their specific intrusion method. The company did not disclose the name of the third-party cloud service provider and said it had not received direct contact or blackmail demands from the attackers. Whether this incident was a targeted attack on the cloud storage system or a data theft using a security vulnerability in a third-party service remains to be investigated further.
Iris Oyama reminds consumers that if the password they have used at Iris Plaza is also used on other websites or network services, they should change the relevant account password as soon as possible. Since this incident involves personal information such as name, address, phone number, and date of birth, attackers may also use this real information to carry out precise phishing scams in the future, such as posing as a shopping platform to send refund notices, logistics anomaly reminders, or account security warnings.
The company specifically reminds users to be wary of emails, text messages, phone calls and fake websites pretending to be Alice Oyama and related government agencies. Official staff will not ask users to provide passwords, personal identification numbers or authentication codes via email or text messages, nor will they ask users to enter such sensitive information through unknown links.
For consumers who may be affected, the company plans to notify consumers one by one via email and other methods based on the progress of the investigation. There is currently no online tool available to publicly check whether an individual has been affected.
This incident once again highlights the data security risks faced by large retail companies relying on third-party cloud services. Even if the company's own official website and internal systems are not directly attacked, as long as there are security vulnerabilities in the external cloud platform that stores customer data, the information of millions of consumers may still be exposed. For retail companies with huge user databases, permission management, data encryption, access monitoring and supplier security review of third-party cloud services have become security links that cannot be ignored.
Comments