Japanese retailer reports data breach affecting 7.7 million people
What's the story
Iris Ohyama, a leading Japanese consumer goods manufacturer, has reported a major data breach. The incident has potentially exposed the personal information of around 7.7 million people to cybercriminals. The security lapse was caused by unauthorized access to an external cloud service used by Iris Plaza, the company's online shopping platform.
Company profile
Iris Ohyama's global presence and product range
Iris Ohyama is a major player in the consumer goods industry, offering a wide range of products from household items to healthcare supplies.
The company, which had 13,670 employees worldwide as of January 2026, has manufacturing facilities across North America, Europe, and Asia.
The recent data breach incident highlights the vulnerabilities even such established companies face in today's digital landscape.
Breach specifics
Breach impacts millions of users
The company first revealed the threat and said it had temporarily suspended access to Iris Plaza and related systems.
However, a recent update from Iris Ohyama revealed that the breach affected some 5.8 million registered members/former members, as well as 1.9 million non-members.
The exposed user data includes full names, physical addresses, phone numbers, email addresses, gender, and date of birth.
Company response
No credit card details stored in affected service
Iris Ohyama has said that some data, including passwords, were encrypted but did not specify the encryption method used.
The company also clarified that credit card details were not stored in the affected service.
Despite the breach, Iris Ohyama has reported no cases of fraudulent use or financial damage related to this incident.
User advisory
What should Iris Ohyama users do?
In light of the data breach, Iris Ohyama has advised users who use their Iris Plaza password on other platforms to change their credentials immediately.
This is to prevent cybercriminals from using the same password to access other online accounts.
The company has also assured customers that it will not ask for passwords, PINs, authentication codes, or any sensitive information through links in emails/SMS.