Source: BleepingComputer
Japanese manufacturer Iris Ohyama has confirmed that personal information belonging to roughly 7.7 million people may have been exposed after attackers gained unauthorized access to a third-party cloud service used by its Iris Plaza online store. In an update published on 5 November 2026, the company said data stored in the external cloud service may have been viewed or obtained by outside actors, covering around 5.8 million registered and former members plus about 1.9 million non-members.
What happened
The company detected the unauthorized access on 28 October 2026, immediately suspended Iris Plaza and related systems and blocked the access route, and reported the incident to police and Japan’s Personal Information Protection Commission on 29 October. The data potentially exposed includes names, addresses, phone numbers, email addresses, gender, birth dates and passwords, with passwords and some other fields encrypted. Credit card information was not stored in the affected cloud service, and no fraudulent use or financial damage has been confirmed so far. The investigation into the exact number of records accessed is still ongoing.
The third-party lesson for European businesses
The breach follows a familiar pattern that has repeatedly hit European organisations this autumn, from supply-chain intrusions at banks to compromises entering through service provider platforms. The common thread is that the victim’s own security posture matters less than the weakest vendor in its chain. Under GDPR, controllers remain accountable for data processed on their behalf, and NIS2 pushes the same expectation of supplier risk management onto a much wider set of organisations. Any business that hands customer data to an external SaaS or cloud tool without contractual safeguards, access audits and its own logging is carrying the same blind spot that Iris Ohyama just paid for in headlines and a suspended storefront.
Practical steps include maintaining an inventory of every third-party service that stores customer data, demanding security terms and breach notification windows in contracts, monitoring for suspicious files and access in vendor-held environments where possible, and preparing a rehearsed disclosure path so a 28 October detection can become a 29 October notification rather than a weeks-long silence.
If your organisation relies on external cloud services to hold customer data and you want help assessing third-party risk, tightening supplier security under GDPR or building an incident response plan that holds up in practice, contact Excello Digital for professional advice.