Iris Ohyama (Iris Plaza online store) data breach

What happened

Iris Plaza, which runs Japanese appliance and homeware maker Iris Ohyama's official online store, found suspicious files in an external cloud service it uses on October 28, 2026 and shut the store down. In its second notice on November 5 it said data stored there may have been viewed or taken, covering about 7.7 million people: about 5.8 million members, including former members, and about 1.9 million non-members who bought without an account or entered campaigns. Member data includes names, addresses, phone numbers, email addresses, gender, encrypted passwords and dates of birth; non-member data includes names, addresses, phone numbers and email addresses. Credit card data was not stored in the affected service, and no misuse has been reported so far.

What should I do?

1. Change your password on any other site where you used the same password as your Iris Plaza account.
2. Don't click links or open attachments in unexpected emails or texts about Iris Ohyama orders or refunds; Iris Plaza says it will never ask for passwords, PINs or codes.
3. Watch out for fake Iris Ohyama websites and social media accounts, and don't enter card details or passwords on them.
4. Be wary of calls or letters that know your name, address and birthday and ask for payment or personal details.

More data breaches in Japan →

Check the other services you use →