Iris Ohyama has reported a data breach potentially affecting personal information of approximately 7.7 million individuals. The breach was identified on October 28, 2026, and involved unauthorized access to a third-party cloud service.
The company confirmed the unauthorized access and publicly disclosed the incident on October 29, 2026. Of those affected, 5.8 million are current and former members, while 1.9 million are non-members.
Exposed data includes names, addresses, phone numbers, email addresses, dates of birth, gender information, and encrypted passwords. Importantly, credit card information was not stored in the compromised cloud service.
As of November 5, 2026, there have been no reports of misuse of the exposed information or any financial loss linked to the incident. Iris Plaza's online store and related systems were suspended on October 28, 2026, as a precautionary measure.
The incident has been reported to Japan’s Personal Information Protection Commission and the police. An investigation is underway, with external experts assisting in the process.