Iris Ohyama Breach Exposes 7.7 Million Customers' Data

What was stolen and how did it happen?

Iris Ohyama discovered suspicious files on an external cloud service on October 28, 2026, and later confirmed that attackers had stolen data on 7.7 million people.

The breach affected both members and non-members of Iris Plaza. Member data on approximately 5.8 million people included names, addresses, phone numbers, email addresses, genders, dates of birth, and encrypted passwords for some users. Non-member data on 1.9 million people was limited to names, addresses, phone numbers, and email addresses.

The company stressed that credit card information was not compromised. However, it did not specify the encryption method used for passwords, leaving open the possibility that attackers could crack weak hashes offline.

Iris Ohyama temporarily suspended the Iris Plaza site to ensure customer safety and has notified Japan's data protection watchdog and local law enforcement. The company says it has received no ransom demands and has not identified the attackers.

Why encrypted passwords are not a free pass

While encrypted passwords are better than plain text, the lack of details on the encryption method means users should still change their credentials, especially if they reuse passwords.

Encryption or hashing makes it harder for attackers to directly use stolen passwords, but weak algorithms or poor implementation can be cracked. Iris Ohyama has advised users to update their login credentials, particularly those who use the same password across multiple services.

Credential stuffing attacks, where attackers try stolen username-password pairs on other sites, are a common follow-up to breaches. So even if the Iris Ohyama passwords are hashed, reusing them elsewhere puts other accounts at risk. The pattern echoes other recent incidents where stolen credentials were reused across services, as seen in the DreamHost breach that exposed FTP and webmail logins.

A rough season for Japanese companies

Iris Ohyama is the latest in a string of cyberattacks targeting Japanese organizations, including GMO, Burger King Japan, and Daiichi Kosho.

In recent months, Japan has seen a wave of breaches. Burger King Japan lost data on 11.18 million customers, and a malware attack on Daiichi Kosho's supply chain compromised 8.7 million customers and employees. The GMO attack was particularly disruptive, with the company urging customers to unplug their PCs.

Iris Ohyama, a household name in Japan with annual revenue of $1.53 billion, joins a growing list of major Japanese firms grappling with security incidents. The company has manufacturing and distribution operations in the US, Europe, China, and South Korea, but the breach appears to be limited to its Japanese e-commerce platform. The incident also follows a broader trend of large-scale breaches, such as the Harvard breach that hit 851,000 accounts.

What it means for you

If you have an account on Iris Plaza, change your password immediately and enable two-factor authentication if available. Also change any other accounts where you used the same password. The breach is currently limited to Japan, but if you shopped on Iris Ohyama's international sites, monitor your accounts for suspicious activity.

Iris Ohyama has not announced any global impact, but the company's international presence means customers outside Japan should stay alert. There is no evidence of the data being misused yet, but phishing attempts could follow.

Iris Ohyama's breach is a reminder that even encrypted passwords demand vigilance. With no ransom demand or leak yet, the full impact remains unclear, but users should act now to protect their accounts.