Iris Ohyama Cloud Service Breach Exposes Personal Data of 7.7 Million Customers

What happened

Iris Ohyama, operator of the Iris Plaza online store, discovered that a cloud service used to host the platform had been accessed by an unauthorized third party. The breach was identified in late October 2026, leading the company to suspend the site and related systems. Investigation confirmed that personal information—including names, addresses, phone numbers, email addresses, gender, dates of birth, and encrypted passwords—may have been accessed. No credit‑card data were stored in the affected cloud, and no misuse of the data has been reported. The incident was reported to Japan’s Personal Information Protection Commission and law enforcement on October 29, 2026.

Why it matters for trust and compliance

• The incident tests the control objective of continuous third‑party risk management, a requirement that maps to many frameworks such as NIST CSF 2.0 governance.
• Provides evidence of the need for continuous monitoring of third‑party cloud access logs.
• Highlights the importance of documented vendor risk assessments for audit readiness.

Who is affected

Recommended actions

1. Perform a comprehensive risk assessment of the cloud provider and update contracts with security clauses.
2. Enable continuous monitoring of cloud‑service access and enforce least‑privilege permissions.
3. Refresh incident‑response procedures to include third‑party breach scenarios.