If a vendor holds your customer records, your breach notice may be written about someone else’s systems. Iris Ohyama, the Japanese manufacturer behind the Iris Plaza online store, says personal data on up to 7.7 million people may have been exposed through an external cloud service. The lesson for operators is practical: know what each outside service stores, how it is protected and how fast you can shut it off.

What happened

According to BleepingComputer, the company found a suspicious file in a third-party cloud service used by the Iris Plaza store, and discovered the incident late last month. It suspended Iris Plaza and related systems, including the SIMPLE STYLE online store, on October 28. It then confirmed unauthorized third-party access and disclosed it in a first notice on October 29. That notice carried limited detail.

The company says customer data held in the affected service may have been accessed. It is still working out how many records were exposed, but the impact reaches up to 5.8 million registered and former members and 1.9 million non-members. The exposed data types vary by person. Former members have no stored passwords, and active members’ passwords are kept in encrypted form, though the company did not name the scheme. It also said credit card information was not stored in the affected cloud service.

As of November 5, Iris Plaza had received no reports of misuse or financial loss. A spokesperson told BleepingComputer the company has had no direct communication from the attacker and has not identified the perpetrators. Japan’s Personal Information Protection Commission and police were notified on October 29. Websites for Iris Tech Service Co. services, including appliance subscriptions and delivery and installation, were suspended too.

Why it matters

The headline number is large, but the structure is the story. The attack hit an external service rather than the retailer’s own systems, yet the retailer suspended its store and affiliated sites and notified regulators and police. This suggests a vendor compromise can force the same disruptive response as a first-party breach, with costs such as lost sales and customer communication that the company has not detailed.

The 1.9 million non-members matter too. Guest checkout and past-customer data often sit alongside account data, and teams rarely track them as carefully. Former members are a similar case. Data kept after a relationship ends still counts as exposure when a vendor is breached.

Consumer brands hold customer databases that attackers clearly find worth pursuing, and a single incident like this one cannot show a wider pattern. For more on how attackers get into systems, see our cybersecurity coverage.

What it means for you

Map your data, not just your vendors. List every external cloud service that holds customer records, and note which fields each one stores. Many teams can name their vendors but cannot say whether a given service holds guest data, order history or old accounts.

Ask vendors specific questions. How is stored data encrypted, and who holds the keys? How are access credentials issued, scoped and rotated? What logging will you receive, and how quickly will the vendor tell you about suspicious access? Iris Plaza’s unspecified description of password encryption is a reminder to get the scheme in writing, because the details determine how bad a leak is.

Cut what you keep. Set retention limits for former customers and non-members. Data you deleted cannot leak from a vendor. Check too which services hold payment data. Iris Plaza says card data was not in the affected service, which is the kind of separation worth confirming for your own vendors.

Rehearse the shutdown. Work out who can suspend a storefront and its linked services, what that costs per day and who talks to regulators. Add vendor-side incidents to your response plan, and make sure your contracts require prompt notice.

Prepare customer guidance. After a leak of contact details, expect phishing that cites the incident. Plan clear messages that tell customers what you will never ask for.

What to watch

  • The final count of affected records, which the company is still determining and which could differ from the 7.7 million ceiling.
  • Whether the company names the cloud provider or explains how the attacker gained access.
  • Any ransom demand, claim of responsibility or sign of the data being misused or sold.
  • Any action by Japan’s Personal Information Protection Commission, and when the suspended stores return.

Sources