Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk

No reopening date as orders face delays and some customers are told to refuse deliveries to cancel purchases

Japanese electronics giant Iris Ohyama has taken down its online store after discovering that attackers may have accessed the personal information of 7.7 million customers, leaving shoppers unable to place orders.

The retailer, which sells everything from home appliances and furniture to pet supplies, first disclosed the incident on October 29, a day after discovering a suspicious file on a third-party cloud service used by its Iris Plaza ecommerce operation.

Iris Plaza immediately suspended its website and associated systems and began investigating, subsequently confirming unauthorized access.

REG AD

Iris Ohyama has since revealed that the potentially compromised cloud environment contained personal information belonging to approximately 5.8 million registered customers, including former members, and another 1.9 million people who had purchased products without creating an account or participated in promotional campaigns.

REG AD

The potentially exposed information includes names, addresses, phone numbers, email addresses, dates of birth, gender, and passwords, although the company says the exact information at risk varies between customers.

Some of that data, including passwords, was encrypted, but Iris Ohyama hasn't explained what protection was used. It has advised customers who reused their Iris Plaza passwords elsewhere to change them, presumably before someone else gets the opportunity.

There is some good news for anyone who has handed over their credit card details, as the retailer says it didn't store payment information in the affected cloud service and that it hasn't been compromised.

It remains unclear whether the attackers actually made off with any personal information. In its FAQ, Iris Plaza says it is still investigating the possibility of a data leak and has yet to establish the full extent of the intrusion.

Meanwhile, Iris Plaza's website is still down, and the company isn't saying when it'll be back. Orders are also taking longer to ship, while customers trying to cancel a purchase have been told they may have to turn the delivery driver away if their parcel arrives before the cancellation is processed.

Fortunately for anyone desperate to buy a new rice cooker, Iris Plaza's stores on Rakuten, Yahoo! Shopping, and auPAY Market are still operating. The company says it has found no evidence that those stores were affected.

Iris Ohyama has reported the incident to Japanese authorities and says it will contact potentially affected customers individually. It has also warned shoppers to watch out for phishing emails, fraudulent calls, and fake websites impersonating the retailer.

The company has yet to identify the cloud provider involved, explain how the attackers got in, or establish whether any of those 7.7 million records actually left its systems. ®