What happened. Iris Plaza, the company that runs the official online store of Iris Ohyama (Sendai, Japan), found a suspicious file in an external cloud service it uses on Oct 28. It shut the store and related systems the same day, confirmed third-party unauthorized access, and reported to police and Japan's Personal Information Protection Commission on Oct 29. In its second notice on Nov 5, it said data stored in that cloud service may have leaked, covering about 7.7 million people. The actual number leaked is still being investigated, and the company says it has seen no fraud or financial loss so far. The cloud provider and the way in are Undisclosed.
What was exposed. About 5.8 million members (including people who closed their accounts): names, addresses, phone numbers, emails, gender, dates of birth and passwords, which the company says are encrypted (closed accounts exclude passwords). About 1.9 million non-members who bought without signing up or entered campaigns: names, addresses, phone numbers and emails. Not every person has every field. Credit card data was not kept in that cloud service. As a precaution, the SIMPLE STYLE home store and Iris Tech Service's appliance-subscription and delivery-installation sites were also taken offline, with no access found there.
Why this matters to an enterprise. It lands days after NTT Docomo's breach notice and the same week Japan announced an emergency cybersecurity package after a wave of attacks on companies and agencies. The lesson is the plain one: the hole was in a third-party cloud service holding a full customer copy, not the storefront. Inventory which SaaS and cloud stores hold your full customer tables, check who can read them, and alert on unusual bulk reads. If your staff shop on Iris Plaza, expect Iris-branded phishing and push password changes where passwords were reused.