SockAnalystIris Ohyama's Iris Plaza breach: about 7.7 million people's data may be exposed via an external cloud service
SockAnalyst · Security+ certified analyst.
What happened
Japanese manufacturer Iris Ohyama's Iris Plaza online store operator, Iris Plaza Inc., said on November 5, 2026 (second notice) that data held in an external cloud service it uses may have been leaked, covering about 7.7 million people. It found a suspicious file in that cloud service on October 28, shut down Iris Plaza and related systems, confirmed third-party unauthorized access, and made a first notice on October 29. The company says about 5.8 million are members and former members (names, addresses, phone numbers, emails, gender, birth dates and, for current members, encrypted passwords) and about 1.9 million are non-members such as guest buyers and campaign entrants (names, addresses, phones, emails). Not everyone has every field, and actual leaked counts are still under investigation. Credit card data was not stored in the affected service, no misuse or financial loss had been reported as of November 5, and police and Japan's Personal Information Protection Commission were notified on October 29. Sister sites SIMPLE STYLE and Iris Tech Service subscription and delivery services were also suspended. How the attacker got in has not been disclosed.
Who's affected
Roughly 5.8 million current and former Iris Plaza members and 1.9 million non-members (guest purchasers, campaign applicants). Anyone in those groups is a phishing and smishing target, and members who reused their Iris Plaza password elsewhere are at risk of credential stuffing.
✅ Fix / patch
- Iris Plaza customers: change the password anywhere you reused your Iris Plaza password, and ignore messages claiming to be Iris Plaza that ask for passwords, PINs or codes (the company says it will never ask for them).
- Treat unexpected emails, SMS, calls and lookalike sites or social accounts referencing Iris Plaza as suspect.
- Defenders in retail and e-commerce: inventory third-party cloud services that hold customer data, enforce MFA and least-privilege access on them, and alert on bulk reads or exports of stored objects.
- Watch your own login endpoints for credential-stuffing spikes using Japanese retail breach lists.
🔎 Quick hunt check
No IOCs published. Iris Plaza has not released attacker IPs, tools or the intrusion method. Hunt for bulk object listing or download from cloud storage by a single identity, new access keys or tokens created on cloud services holding customer data, and credential-stuffing patterns on login pages.
MITRE ATT&CK: T1078.004, T1530, T1619, T1098.001
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
index=cloud (sourcetype="aws:cloudtrail" OR sourcetype="azure:monitor:activity" OR sourcetype="google:gcp:pubsub:message")
(eventName IN ("ListObjects","ListObjectsV2","GetObject","CreateAccessKey","CreateLoginProfile") OR operationName="*Blob*")
| bin _time span=15m
| stats count as ops dc(requestParameters.key) as objects values(eventName) as events by _time, userIdentity.arn, sourceIPAddress
| where ops>=500 OR objects>=200
| sort - ops
// Bulk object reads/listing or new access keys on stores holding customer data = Iris Plaza-style cloud data theftlet window = 30d;
let bulkRead = AzureDiagnostics
| where TimeGenerated > ago(window) and ResourceProvider == "MICROSOFT.STORAGE"
| where OperationName in ("GetBlob","ListBlobs","GetBlobProperties")
| summarize Ops=count(), Blobs=dcount(Uri_s) by CallerIPAddress, bin(TimeGenerated, 15m)
| where Ops >= 500 or Blobs >= 200;
let newCreds = AuditLogs
| where TimeGenerated > ago(window)
| where OperationName has_any ("Add service principal credentials","Update application – Certificates and secrets management")
| project TimeGenerated, OperationName, InitiatedBy, TargetResources;
bulkRead
| extend Kind="BulkRead"
| union (newCreds | extend Kind="NewCredential")
// Bulk storage reads and new app credentials on cloud services holding customer data⏱ CISA deadline
Not in CISA KEV as of Nov 14, 2026.
Sources
Related playbooks
- Mirae Asset Securities hacked twice in two days: 3,800 customer account numbers and 35,255 staff records leaked · Data breach · 2026-11-07
- Apify breach: compromised credential exposed customer accounts, 2FA recovery codes and sign-in tokens · Data breach · 2026-11-14
- ARARA Message breach: 81 million email addresses taken from Japanese email-delivery service · Breach · 2026-11-07
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free