Iris Plaza Hack Exposes Data of 7.7 Million Shoppers

Iris Ohyama, the Japanese household goods and appliance maker behind the Iris Plaza shopping platform, says it spotted the intrusion on October 28. The company yanked the site offline, cut related systems loose and brought in outside investigators. The platform is still down while the company works out how the attackers got in and what needs fixing.

The numbers break into two piles. Some 5.8 million current and former members may have lost names, addresses, phone numbers, email addresses, dates of birth, gender details and encrypted passwords. Another 1.9 million people never registered at all — they're guest buyers whose names, addresses, phone numbers and emails were exposed.

One bright spot: the compromised external cloud service doesn't hold credit card data, according to Iris Ohyama. The company also says no physical Iris Plaza store has been affected. It has blocked the attackers' access to the service, alerted law enforcement and regulators, and kept external experts on the case.

In its incident FAQ, the company said: “At this time, there have been no reports of unauthorized use or financial damage resulting from this incident.”

The fallout is spreading beyond the main store. Iris Ohyama has also paused Simple Style, its home fashion specialty shop, along with the group's home appliance subscription and delivery-and-installation services and new site applications. The company says it has no evidence those properties were compromised.