Ing. Calogero Bono
The Japanese manufacturer Iris Ohyama has confirmed unauthorized access to an external cloud service used by its online store, Iris Plaza. According to the company, the data of around 7.7 million people may have been exposed. The incident was discovered on October 28 and reported on October 29, and the site has been suspended. It matters because it shows how a third-party cloud provider can become the weak point of an e-commerce business.
A few terms before we get into the facts. External cloud is a storage service run by a third-party provider, not by the company itself. Hash and encryption are ways of not storing passwords in plain text, but their strength depends on the method chosen. Credential stuffing is the attempt to use stolen emails and passwords on other services. Phishing is deception via email, phone or fake websites to get people to hand over their data. Ransomware is an attack that demands a ransom, and here no demand has been reported.
What happened to Iris Ohyama?
According to BleepingComputer, the company found a suspicious file in an external cloud service used by Iris Plaza. It immediately suspended the store and connected systems, then confirmed access by third parties.
The first notice came on October 29. A week later a more detailed account followed, as reported by TechRadar. The company notified Japan's personal data protection authority and the police.
Which data ended up in the breached cloud?
The figures mention about 5.8 million current and former members and 1.9 million non-members. For members, the data may include name, address, phone number, email, gender, date of birth and password. For non-members, according to TechRadar, only name, address, phone number and email.
The data varies from person to person. For former members, for example, no stored passwords have been reported. The company states that credit card data was not in the cloud involved.
Are the encrypted passwords safe?
Not entirely. Some users' passwords were encrypted, but Iris Ohyama did not explain which method was used. If the protection were weak, someone could try to crack it offline, as TechRadar notes.
The real risk concerns people who use the same password elsewhere. The company advises changing it on other services too. It is the same pattern seen in Chainalysis, where attention focused on password hashes.
Is the online store still working?
The Iris Plaza site remains offline, and The Register reports that the company has not said when it will return. Shipments are slower, and customers who cancel an order may have to refuse the package on delivery.
Iris Plaza stores on Rakuten, Yahoo! Shopping and auPAY Market remain active and, for now, are not reported as involved. The sites of Iris Tech Service services are also suspended.
Limits to know
It remains unclear whether the data was actually copied. According to The Register, the company is still investigating and has not established the full extent of the intrusion. It is not known which cloud provider was involved, nor how the attackers got in. No group has claimed the attack, no ransom demand has been reported, and as of November 5 there were no reports of abuse. The numbers could change.
What changes for people working in digital
If you run an e-commerce business, your provider's cloud should be treated as part of your security perimeter. Ask who has access to customer data and how long you keep it. In this case, for example, data from former members and buyers without accounts also remained stored. If you handle personal data, make sure you have the procedure described in data breach and GDPR notification for small businesses ready. A shop offline for days costs sales as well as reputation, so an alternative sales channel is also worth having.
Our take
The case shows a common mistake, namely considering an archive secure simply because a provider holds it. Responsibility toward customers remains with the company. It is also striking that there is no explanation of how passwords were protected, a detail customers would need right away. A more precise communication would reduce the risk. Along the same lines, after the attack on Smartbox, customers are left having to guess what to do.
Frequently asked questions
Were credit card details stolen?
No, according to the company. Iris Ohyama states that payment information was not stored in the cloud involved. The risk tied to names, contact details and other personal data remains.
How many people are involved?
Up to 7.7 million, according to the company. That is about 5.8 million current and former members and 1.9 million non-members. The final count is not yet closed.
Who attacked Iris Ohyama?
Unknown. The company told BleepingComputer it had received no direct communications or ransom demands. No group has claimed the attack.
What should an affected customer do?
Change your password, especially if you use it elsewhere. The company also warns about emails, phone calls and fake sites impersonating it. It is best not to click on links received in messages.
Why is a cloud provider a risk?
Because customer data sits outside your own systems. If the provider or its access is compromised, the impact falls on the customer company. Access controls and keeping less data are needed.
What to watch in the Iris Plaza investigation
The coming weeks will show whether the data really leaked and which link in the chain gave way.
- Check whether the company names the cloud provider and the method used to protect passwords.
- Follow the reopening date of Iris Plaza and any individual notifications sent to customers.
- Verify whether the data appears on criminal forums or in phishing campaigns.
Sources
- techradar.com, Another huge data breach hits a major Japanese company — Iris Ohyama attack exposes info of 7.7 million customers
- theregister.com, Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk
- bleepingcomputer.com, Iris Ohyama data cloud breach exposes info of 7.7 million customers
