Iris Ohyama discloses cloud breach affecting 7.7 million Iris Plaza customers

Iris Ohyama disclosed on October 29 that personal data about 7.7 million people may have been exposed after an intruder reached a cloud service used by its Iris Plaza online store.

The company said it discovered a suspicious file in the external cloud service on October 28, and that an outside party had gained access without permission to that environment. “We confirmed unauthorized access by a third party and disclosed it in our first notice on October 29,” Iris Ohyama said.

CyberInsider reported that the company blocked the unauthorized access route. In a second disclosure after its October 29 report, Iris Ohyama said data held on the cloud may have been taken outside. Iris Plaza and related systems were shut down on October 28 to contain unauthorized activity and preserve forensic evidence.

Iris Plaza, based in Sendai, Japan, runs the Iris Ohyama official online store within the Iris Group. The storefront serves as the group’s flagship e-commerce site for direct sales of home appliances, lighting equipment and consumer goods. Iris Ohyama Group manufactures household products including storage units, LED lighting, home appliances and garden accessories. Iris Ohyama sells goods ranging from household items to home appliances, and its online shop is a key sales channel for the group.

Potentially affected registered members and former members total as many as 5.8 million, and about 1.9 million non-members, such as guest shoppers and campaign participants, may have been affected. The total potential exposure is approximately 7.7 million individuals. The exact number of affected records and individuals remains under investigation.

The exposed data types vary per individual based on what each person registered, and may include full names, physical addresses, phone numbers, e-mail addresses, gender information, dates of birth and account passwords.

The affected system did not store passwords belonging to former members, while active registered member passwords are kept in encrypted form. The company did not disclose the encryption scheme or method used for those passwords. Payment card details were not kept on the breached cloud service. Some non-member records may include passwords stored in encrypted form, while former members had no password data.

On November 5, the retailer said no one had reported misuse of the leaked information or money losses from the breach. An Iris Plaza spokesperson said the company got no direct messages from the person behind the attack, and the company has not identified the perpetrators. Undercode News says the publicly disclosed evidence so far is insufficient to label the incident a ransomware attack, noting that without direct attacker communications or ransom demands, the incident cannot yet be classified as ransomware.

Iris Plaza began notifying potentially affected customers on November 5. The firm plans to e-mail potentially affected customers one by one as soon as more information is available. Iris Ohyama first disclosed the incident on October 29, and told authorities in Japan, including the Personal Information Protection Commission and police, on October 29.

Undercode News states that third-party cloud infrastructure has become an important security concern for modern businesses, and that firms that put customer databases on third-party infrastructure still have a duty to protect that information. BigGo Finance says businesses are being examined over whether they properly reported to Japan’s Personal Information Protection Commission, and says password reuse makes customers more likely to feel the effects spread further.

The company warns of impersonation e-mails, text messages, calls, websites and social media accounts. Authentic messages never ask for sensitive information such as passwords, PINs or authentication codes. Customers who reused the Iris Plaza password at other services need to change it on those other services.

The company says there are no confirmed cases of unauthorized access or information leaks at stores on third-party online marketplaces. Neither the SIMPLE STYLE site nor Iris Tech Service has confirmed a breach or unauthorized entry. The SIMPLE STYLE online store has been offline since October 28. Iris Tech Service Co., Ltd. shut down its sites and stopped new applications for appliance subscriptions, furniture delivery, appliance delivery and installation on October 28.

No reopening date has been set for the online store. Iris Plaza plans to announce a reopening date after identifying the cause and implementing recurrence-prevention measures, with no timeline set.

CyberInsider reports that as of its November 5 update, Iris Plaza is continuing its investigation and recovery efforts with authorities and external specialists. The company will keep investigating and work with outside specialists and relevant authorities to recover.

BigGo Finance warns that a prolonged shutdown could hurt online sales and new customer sign-ups before the year-end shopping season. BigGo Finance states that going forward, the focus will be on investigating the cause and taking preventive steps to rebuild trust.