- Iris Ohyama discloses breach affecting 7.7 million individuals after attackers compromised its ecommerce platform
- Exposed data included personal details and some encrypted passwords, prompting password reset recommendations
- Company continues investigating the attack, with no ransom demand, attribution, or confirmed misuse reported
Major Japanese consumer goods manufacturer Iris Ohyama has confirmed suffering a cyberattack which saw it lose data on 7.7 million people.
The company first disclosed the breach on October 29, 2026 when it confirmed “unauthorized access on the e-commerce site” Iris Plaza. At the time, the company said its investigation was ongoing, and that it would temporarily suspend the site to ensure customer safety. While it was looking into possible data leaks, it stressed that credit card information was not taken.
A week later, Iris Ohyama came forward with a more detailed report, in which it said that on October 28, if found “suspicious files” on an external cloud service it used. The subsequently launched investigation confirmed that the attackers stole sensitive data on 7.7 million people, which included member data on approximately 5.8 million people, and non-member data on 1.9 million.
Member data included names, addresses, phone numbers, email addresses, genders, dates of birth, and encrypted passwords (for some users). The non-member data was limited to names, addresses, phone numbers, and email addresses.
Hashed passwords and stolen credentials
The fact that the passwords were encrypted is good news, since it means the accounts cannot be accessed that easily. However, the company did not say which encryption or hashing method it used, so it is possible that the attackers could break some of them offline. It is thus no wonder the company warned users to update their login credentials, especially for those who use the same password for other services.
Those that do use the same passwords across various platforms are also at risk of having all of them compromised, since threat actors are known for trying out the stolen combinations across a multitude of services.
We don’t know who targeted Iris Ohyama, and to what end. No threat actors have yet claimed responsibility for this attack, the data has not yet leaked to the dark web, and we’ve found no evidence it was used in phishing or social engineering attacks.
In a statement given to BleepingComputer, the company said it received no direct communication from the threat actors, no ransom demands, and did not know who they were.
We also don’t know which third-party cloud service Iris Ohyama used, which malware was used, or how it was planted there. In the meantime, the company notified the country’s data protection watchdog agency, as well as local law enforcement authorities.
Targeting Japanese organizations
Over the last few months, Japanese organizations have experienced a barrage of cyberattacks, targeting firms of different sizes and in different industries. Just last month, we reported on an attack on GMO, a data breach incident at Japanese Burger King, and a malware attack on Daiichi Kosho. The GMO attack was particularly worrisome, since the company urged its customers to “unplug any cords connected to your PC”.
Burger King Japan also recently lost sensitive data on 11.18 million customers, most of which were using the company’s official smartphone app, while a malware attack on Daiichi Kosho’s supply chain resulted in the compromise of 8.7 million of both customers and employees.
All of these are large organizations and major enterprises, and Iris Ohyama is no exception. The company is a large consumer goods manufacturer, known for household appliances and everyday products, and has been around for decades offering air conditioners, vacuum cleaners, kitchenware, lighting, pet food and accessories, as well as different food products like rice and water.
For the financial year 2025, the company reported an annual revenue of $1.53 billion, with a headcount of more than 6,300. It also has a substantial international presence, with manufacturing and distribution operations in the US, Europe, China, and South Korea.
