A file that had no business being there sat in a third-party cloud service used by Iris Ohyama. Within a day its shopping site went dark. More than two weeks on, the Japanese homeware maker still will not say when orders resume.
SecurityWeek dates the discovery to October 28, the Register to October 29, with disclosure the day after. Iris Plaza was suspended immediately along with related systems, and the investigation confirmed unauthorized access to that cloud environment.
Who is in the record count
The company puts the total at risk at 7.7 million people. Roughly 5.8 million are current and former members, whose names, addresses, phone numbers, email addresses, dates of birth, gender and passwords sat in the affected service. The other 1.9 million bought without registering or joined a promotion; their exposure is contact data, no credentials.
Some password data was encrypted, though Iris has not said how, and it has told customers who reused the password elsewhere to change it now. Cards were not stored there, so cardholders are out of scope.
Whether records actually left the network remains unresolved. The company’s FAQ says a leak is still under investigation and the full extent unknown.
The operational cost
Checkout does not exist, shipping slips, and customers who cancel are told to refuse the parcel if it arrives first. Sibling operations took defensive hits: the Simple Style store, appliance subscriptions and new signups were paused with no compromise evident.
Rakuten, Yahoo! Shopping and auPAY Market keep selling, reported unaffected. Iris has notified regulators, will contact affected people directly, and warns shoppers about phishing mail, calls and lookalike sites.
For everyone else the lesson is unsentimental. A retailer’s blast radius is defined by the vendors it hands customer data to.
