The Iris Ohyama Data Breach Put 7.7 Million Shoppers Into One File

November 9, 2026 · 7 min read

Someone ordered a set of storage bins from Iris Plaza years ago, used the account once, and closed it. Their name, home address, phone number, email address, gender and date of birth sat in that file anyway, and last month an intruder reached it. The Iris Ohyama data breach will not send that person a password reset prompt, because the company does not keep passwords for former members. It will send them email, though, from strangers who now know where they live.

Confirmation: confirmed by the company. Iris Plaza Co., Ltd. published a second notice on November 5, 2026.

What happened in the Iris Ohyama data breach

On October 28, 2026, Iris Plaza found a suspicious file in an external cloud service it used. The company stopped the Iris Plaza store and the systems around it the same day, cut off the access route, and started an investigation. It published a first notice on October 29 and reported the incident to the police and to Japan’s Personal Information Protection Commission on the same date.

The second notice, dated November 5, is where the scale arrives. The investigation found that data held in that cloud service may have left it. The stored records cover about 7.7 million people. The company says someone may have viewed or taken that data. It is still counting how many records actually left.

So the 7.7 million figure describes what was sitting there, not a finished tally. Iris Plaza splits it two ways: about 5.8 million member records, including people who had closed their accounts, and about 1.9 million non-member records belonging to shoppers who bought something without registering or who entered a campaign.

Iris Plaza is the official online store for Iris Ohyama, the Sendai manufacturer whose storage boxes, LED lighting, rice cookers and pet supplies sit in millions of homes. Two sibling businesses went dark with it. The company shut the home-fashion store SIMPLE STYLE on October 28, and Iris Tech Service paused its appliance subscription and furniture delivery sites that day too.

What the Iris Ohyama data breach exposed, and what it is worth to a stranger

The two groups lost different things, and no single customer lost every item.

Member records, including closed accounts: name, address, phone number, email address, gender, password and date of birth. Non-member records: name, address, phone number and email address. The company keeps no passwords for former members. It also says some fields, passwords among them, carry encryption. It has not said which scheme protects them. Card details sat elsewhere. The company confirms the affected cloud service held none of them.

Here is what each piece does in the wrong hands. An email address plus a real name turns a generic scam into a letter addressed to you. A phone number invites the text-message version of the same scam. A date of birth and a home address are two of the three answers a call center asks for before it trusts a voice. And an encrypted password is a delay rather than a wall: encryption buys time, and the strength of that time depends on a scheme the company has not described.

The message that comes next wears the company’s name

Iris Plaza began contacting affected customers individually by email on November 5. Scammers read these notices too. A breach notice hands them a script, because it tells millions of people to expect mail on this exact subject.

The company drew the line itself, and it is the most useful sentence in the notice: it will not ask for a password, a PIN or an authentication code, and it will not ask anyone to type those into a page linked from an email or a text.

That gives you a rule for the next few weeks. Treat any message about this incident as a prompt to go look, rather than something to act inside. Type the company’s address into your browser yourself. If a message insists you confirm your details to keep your account, that insistence is the tell.

What to do now

Most of this has nothing to do with us, and it is worth more than anything we sell.

Change the Iris Plaza password, and anywhere else you reused it. A leaked address-and-password pair gets tried on other sites within days. A password manager fixes this permanently, because it makes every password different by default.
Turn on the strongest sign-in each account offers, starting with your email account. A passkey beats an app code, and an app code beats a text message.
Expect the follow-up, then slow it down. Mail and texts about this breach will arrive. Open the site yourself instead of the link.
Watch the phone, not just the inbox. Your number leaked alongside your address, so the call that knows your street name is not proof of anything.
Say no to new credit you did not ask for. Dates of birth and addresses are the raw material for an account opened in your name.

How OptMsg changes this exposure

We cannot undo this, and we would not have stopped it. The Iris Ohyama data breach happened inside another company’s cloud service. So our claim is narrower, and it still helps: it covers what a leaked login can reach afterward.

An OptMsg account has no password, so a password leaked from another site cannot be tried on the inbox. That matters here because the member records paired an email address with a stored password, and your email account is the door that resets every other account you own. Second, mail from a sender you have not approved goes to Trash rather than your Inbox, and it auto-deletes after 30 days. The scam dressed as a store you shopped at once lands there.

Here is where the argument stops. It does not cover a phishing page you sign in to yourself, a compromised device, or someone holding your unlocked phone. It does nothing about the phone number in the leaked file. And a sender you have already approved stays approved, which is why a lure wearing a familiar name still needs your judgment. Security-first email is a smaller promise than it sounds, and it holds.

If 7.7 million strangers’ details just changed hands, the useful question is what any of them can still deliver to you. Start a free 14-day Reader trial, forward your existing mail, and see what arrives when the list decides nothing.

Create Your Account

Frequently asked questions

Was I affected by the Iris Ohyama data breach?
If you bought from Iris Plaza, entered one of its campaigns, or held an account you have since closed, your details may be in the file. Iris Plaza started emailing affected customers individually on November 5, 2026. Because scammers imitate those messages, check your account by typing the store’s address yourself.

Were credit card numbers exposed?
No. Iris Plaza says card details were not stored in the affected cloud service and were not touched.

My password was encrypted. Am I fine?
Treat it as leaked. The company has not said which encryption scheme it used, so change that password and anywhere you reused it.

Does the 7.7 million figure mean 7.7 million records were stolen?
Not yet. That is the number of people whose records sat in the cloud service. Iris Plaza says the real count of leaked records is still under investigation.

I closed my Iris Plaza account years ago. Why am I in this?
The member total counts people who had withdrawn. Those accounts keep no password, but they still held names, addresses, phone numbers, email addresses and dates of birth.

Sources

Iris Plaza Co., Ltd., second notice (Japanese), November 5, 2026: https://www.irisohyama.co.jp/news/2026/?date=1105
Iris Plaza Co., Ltd., first notice (Japanese), October 29, 2026: https://www.irisohyama.co.jp/news/2026/?date=1029
BleepingComputer, “Iris Ohyama data cloud breach exposes info of 7.7 million customers,” November 8, 2026: https://www.bleepingcomputer.com/news/security/iris-ohyama-data-cloud-breach-exposes-info-of-77-million-customers/