Security Guides

#data breach #passwords #phishing #incident response #Japan

Unauthorized access at Iris Plaza (data on about 7.7 million people): names, addresses and encrypted passwords may have leaked — what members and shoppers should do

Iris Plaza says data on about 7.7 million people in an external cloud service may have been viewed or taken. Member passwords (encrypted) are included.

Published 2026-11-07 Updated 2026-11-07 Last verified 2026-11-07 12 min read

On this page

For: members of Iris Plaza (including people who have left), and people who bought from Iris Plaza without registering or entered one of its campaigns. This article is an explanation based on the official notices from Iris Plaza Co., Ltd.; it does not cover attack methods.

Developing: this article will be updated as the organisation publishes more

Who is affected: members of Iris Plaza (including people who have left), and people who bought from Iris Plaza without registering or entered one of its campaigns.
Confirmed so farSee the table ↓: Suspicious files found and site stopped
Unauthorized access by a third party
Total personal data stored
Listed as possibly affected
Members' name, address, phone, email
Members' gender, date of birth and more
Members' password (encrypted)
1 more
Non-members' name, address, phone, email
Not yet confirmed: Actual number of records leaked and people affected
Cause (how the access happened)
When individual notices will be sent
1 more
When Iris Plaza will reopen
What to do nowSee the steps ↓: Change the password on services where you use the same one
Turn on two-step verification for important services
Do not open links in messages that use the company's name
2 more
Be careful with post and delivery notices too
If you are worried, use the official contact point
Where to verify (source)All sources ↓: Iris Plaza Co., Ltd., second notice on the temporary suspension of the Iris Plaza online store (November 5, 2026, news section of the official Iris Ohyama website; Japanese)
Last checked: As of November 7, 2026

Follow-up plans and what we checked

In its second notice of November 5, the company said it is continuing to investigate the actual number of records leaked and people affected, and that it will contact people individually by email or other means, in turn, based on the results. It says it will announce when Iris Plaza reopens once it has identified the cause and put measures in place to prevent a recurrence. When we checked the Iris Ohyama news index on November 7, 2026, we found no third notice.

What Iris Plaza users should do today

Change the password on services where you use the same one

The company asks people whose personal information may have leaked to change their password on any other service where they use the same one, to prevent misuse.

Member passwords are among the information that may have leaked. The company says they were encrypted but does not say how. An email address and password pair can be tried on other services, so start with the services where you use the same password. For how to check whether a password has leaked, see How to check if your password was leaked.

Turn on two-step verification for important services

After changing passwords, turn on two-step verification (a code or similar check in addition to the password when you log in) for services that would hurt if taken over, such as online banking, shopping and email.

With two-step verification, a known password is often not enough to log in. For which method to choose, see Which 2FA method is safest?.

Do not open links in messages that use the company's name

The company warns that suspicious emails, text messages and phone calls pretending to be the company or related organisations, and fake websites and social media accounts, may appear. If you get a message you did not expect, do not open attachments, do not follow links and do not reply.

The company says it will contact people individually, but that it will never ask for passwords, PINs or verification codes, or ask you to enter them on a page linked from an email or text message. Treat any message that does as fake. For how to spot them, see What is phishing?.

Be careful with post and delivery notices too

The information that may have leaked includes addresses and phone numbers. In general, an address is enough to send postcards, letters or fake missed-delivery notices.

Even if a message carries the Iris Plaza or Iris Ohyama name, check using the contact point on the official website, not a number or URL written in the message.

If you are worried, use the official contact point

The contact point in the notice is the Iris Plaza contact center (toll-free 0120-108-824, weekdays and Saturdays 9:30 to 17:00 Japan time). It is closed over the New Year and summer holidays and on company holidays.

There is also a support chatbot open 24 hours and an FAQ on this incident. Open both from the notice on the official Iris Plaza website.

What happened (from Iris Plaza's notices)

Iris Plaza Co., Ltd. posted a first notice on October 29 and a second notice on November 5 in the news section of the official Iris Ohyama website. The official Iris Plaza website carries the same notice and an FAQ. Everything below comes from the company's notices.

October 28
The company found suspicious files in an external cloud service it uses. It immediately stopped Iris Plaza and related systems and began an investigation, which confirmed unauthorized access by a third party. From the same day it also stopped the SIMPLE STYLE site it runs and the sites of a group company's appliance subscription and delivery and installation services (no unauthorized access or leak has been confirmed for those services).
October 29
First notice. The company said that, so far, no leak of credit card information had been confirmed. It reported the incident to the police and the Personal Information Protection Commission (per the second notice).
November 5
Second notice. The company confirmed that data kept in the external cloud service may have leaked outside, and said that data on about 7.7 million people may have been viewed or obtained.

~7.7 million people

Total personal data stored in the external cloud service (company)

~5.8 million

Member data (including former members)

~1.9 million

Non-member data (including buyers without an account and campaign entrants)

Unaffected

Credit card information (not stored in that cloud service)

Personal information that may have leaked (as of November 5, 2026)

Member data (~5.8 million people): Name, address, phone number, email address, gender, password, date of birth and more. Includes former members. Passwords excluded for former members
Non-member data (~1.9 million people): Name, address, phone number, email address. Includes people who bought without registering and people who entered campaigns
Encryption: Some items, including passwords, are encrypted
Note: Not every item leaked for every person; the items differ depending on what each person registered
Not included: Credit card information (not stored in that cloud service; confirmed as unaffected)
Contact: Iris Plaza contact center, 0120-108-824 (weekdays and Saturdays 9:30 to 17:00 Japan time)

What is known and what is not

This table is based on the company's notices up to the second notice of November 5, as of November 7, 2026. When follow-up notices appear, we will update the status column.

Item	What the notices say	Status
Suspicious files found and site stopped	Found in the external cloud service on October 28 and stopped immediately	Confirmed (company)
Unauthorized access by a third party	Confirmed by the investigation	Confirmed (company)
Total personal data stored	About 7.7 million people	Confirmed (company)
Members' name, address, phone, email	Items in member data (~5.8 million people, including former members)	Possible (company)
Members' gender, date of birth and more	Items in member data	Possible (company)
Members' password (encrypted)	Item in member data. Excluded for former members. Some items are encrypted	Possible (company)
Non-members' name, address, phone, email	Items in non-member data (~1.9 million people)	Possible (company)
Credit card information	Not stored in that cloud service; unaffected	Not included (company)
Actual records leaked and people affected	Still under investigation	Under investigation
Stores on external marketplaces (Rakuten and others)	No unauthorized access or leak confirmed	Not confirmed (company)
Misuse or financial loss	No reports linked to this incident confirmed	Not confirmed (company)
Cause (how the access happened)	Not stated. The company is working to identify the cause	Under investigation
Encryption method	Not stated	Not stated
Individual notices	Will be sent in turn by email or other means, based on the investigation	Under investigation
Reopening of Iris Plaza	Will be announced once decided	Under investigation

'About 7.7 million people' is not a confirmed number of people whose data leaked

The company says the personal data stored in the external cloud service covered about 7.7 million people, and that it has confirmed this data may have been viewed or obtained. The actual number of records leaked and people affected is still under investigation. This article does not describe the figure as the number of people whose data leaked.

What names, addresses, email addresses and passwords can be used for

The points below are what can happen in general when this combination of data leaks; they do not mean it has happened in this incident. The company says no misuse or financial loss linked to this incident has been reported.

Email address + password (encrypted)

↓→

Tried on other services (if the password can be recovered)

→ Change reused passwords; turn on two-step verification

Name + email address + phone number

↓→

Emails, texts or calls posing as apologies, refunds or order confirmations

→ Do not open links; check with the contact point on the official site

Name + address

↓→

Postcards, letters or fake missed-delivery notices

→ Use the official contact point, not the number or URL given

Combinations of items that may have leaked and what to do about each

What the data that may have leaked can be used for

Attempts to log in to services where you reuse the password
Convincing apology or refund messages addressed to you by name and address
Links to fake websites or fake social media accounts

What this data alone cannot do

Card fraud (card data was not stored in that cloud service)
Log in to a service after you have changed the password
Log in with a password alone where two-step verification is on

What operators should review: former members' data and data kept in external clouds

The details of the cause have not been disclosed, so this section only covers what follows from the published facts.

Decide how long to keep data on people who have left. The member data that may have leaked included former members' information (except passwords). Why and for how long former members' data was kept has not been disclosed. In general, deciding which items to keep after someone leaves, and for how long, and deleting them when that period ends, reduces the number of people affected by an incident.
Keep a list of what you store in external cloud services. After finding suspicious files in an external cloud service, the company stopped its site and related systems, and stopped a group company's sites as a precaution. If you list the external cloud services that hold your data and the types of personal data and number of people in each, you can decide the scope and which systems to stop quickly when you find something similar.

Sources (public record)

The facts in this article are based on the public information below. We have not speculated about details of the cause or about leak counts that have not been confirmed.

Iris Plaza Co., Ltd., second notice on the temporary suspension of the Iris Plaza online store (November 5, 2026, news section of the official Iris Ohyama website; Japanese) — irisohyama.co.jp
Iris Plaza Co., Ltd., notice on the temporary suspension of the Iris Plaza online store (October 29, 2026, first notice; Japanese) — irisohyama.co.jp
Iris Plaza Co., Ltd., notice on the temporary suspension of the online store, including an FAQ on this incident (updated November 5, 2026; checked November 7; Japanese) — irisplaza.co.jp
Iris Ohyama news index for 2026 (Japanese) — irisohyama.co.jp

Update history

2026-11-07: First version, based on Iris Plaza Co., Ltd.'s second notice of November 5 and first notice of October 29. We checked the Iris Ohyama news index the same day and found no third notice.

Latest breaking reports

All breaking reports →

FAQ

QWhat may have leaked in the Iris Plaza incident?

According to Iris Plaza Co., Ltd.'s second notice of November 5, 2026, the information that may have leaked is, for member data (about 5.8 million people, including former members), name, address, phone number, email address, gender, password, date of birth and more, and for non-member data (about 1.9 million people), name, address, phone number and email address. Passwords are excluded for former members. The company says not every item leaked for every person; the items differ depending on what each person registered.

QHow can I find out whether I am affected?

The company says it will contact people individually by email or other means, in turn, based on the results of its investigation. Members (including people who have left) and people who bought without registering or entered a campaign are covered. If you are worried, contact the Iris Plaza contact center (toll-free 0120-108-824, weekdays and Saturdays 9:30 to 17:00 Japan time).

QDid passwords or credit card details leak?

Member passwords are among the information that may have leaked (except for former members). The company says some items, including passwords, are encrypted. It asks people who use the same password on other services to change it. It says credit card information was not stored in that cloud service and has been confirmed as unaffected by the unauthorized access.

QIs the cause known?

The company says that on October 28, 2026 it found suspicious files in an external cloud service it uses, and that its investigation confirmed unauthorized access by a third party. Further details of the cause, such as how the access happened, have not been disclosed. The company says it is working to identify the cause and prevent a recurrence.

QWhat should I do if I get a message claiming to be from Iris Plaza or Iris Ohyama?

The company warns that suspicious emails, text messages and phone calls pretending to be the company or related organisations, as well as fake websites and fake social media accounts, may appear. It asks people not to open attachments, follow links or reply. It says that when it contacts customers it will never ask for passwords, PINs or verification codes, or ask them to enter such information on a page linked from an email or text message.

QAre Iris Plaza's stores on Rakuten and other marketplaces affected?

The company says no unauthorized access or data leak related to this incident has been confirmed at the stores it runs on external online marketplaces other than Iris Plaza. Its FAQ says the Rakuten Ichiba, Yahoo! and au PAY Market stores, among others, can be used. The Iris Plaza site itself is stopped, and the company says it will announce the restart date once it is decided.