THE CRUNCH
Japanese homeware and appliance maker Iris Ohyama has taken its Iris Plaza online shopping platform offline after discovering that hackers may have accessed the personal information of 7.7 million people. The company found a suspicious file on an external third-party cloud service used by the platform on October 28, disclosed the incident the next day, and later confirmed unauthorised access. It immediately suspended the site and related systems and launched an investigation.
Of those potentially affected, 5.8 million are current and former platform members whose names, addresses, phone numbers, email addresses, dates of birth, gender and passwords were at risk. The remaining 1.9 million are people who bought without registering or joined promotional campaigns, whose names, addresses, phone numbers and email addresses were exposed. Some data, including passwords, was encrypted, though the company has not explained what protection was used.
There is some reassurance on payments: Iris Ohyama says the compromised cloud service did not store credit card information, and no physical stores were affected. It has advised customers who reused their Iris Plaza password elsewhere to change it, and warned shoppers to watch out for phishing emails, fraudulent calls and fake websites impersonating the retailer.
It is still unclear whether the attackers actually made off with any data. The company says it has blocked the attackers' access, notified Japanese authorities and law enforcement, and hired external experts, but it has yet to identify the cloud provider, explain how the attackers got in, or establish whether any records left its systems. In its FAQ it notes there have been no reports of unauthorised use or financial damage so far.
The shutdown has practical knock-on effects: orders are shipping more slowly, and customers trying to cancel a purchase may have to turn a delivery driver away if a parcel arrives first. Shoppers can still buy through Iris Plaza's stores on Rakuten, Yahoo! Shopping and auPAY Market, which the company says show no evidence of compromise. The company has also suspended its Simple Style home fashion store and the Iris Group's home appliance subscription, delivery and installation services as a precaution, though it has no evidence those were breached too.