Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk
Japanese electronics giant Iris Ohyama has taken down its online store after discovering that attackers may have accessed the personal information of 7.7 million customers, leaving shoppers unable to place orders.
Key points
- The retailer, which sells everything from home appliances and furniture to pet supplies, first disclosed the incident on October 29, a day after discovering a suspicious file on a third-party cloud service used by its Iris Plaza ecommerce operation.
- The potentially exposed information includes names, addresses, phone numbers, email addresses, dates of birth, gender, and passwords, although the company says the exact information at risk varies between customers.
- Iris Ohyama has since revealed that the potentially compromised cloud environment contained personal information belonging to approximately 5.8 million registered customers, including former members, and another 1.9 million people who had purchased products without creating an account or participated in promotional campaigns.
There is some good news for anyone who has handed over their credit card details, as the retailer says it didn't store payment information in the affected cloud service and that it hasn't been compromised.
Additional details
- Iris Ohyama has reported the incident to Japanese authorities and says it will contact potentially affected customers individually.
- Orders are also taking longer to ship, while customers trying to cancel a purchase have been told they may have to turn the delivery driver away if their parcel arrives before the cancellation is processed.
- In its FAQ, Iris Plaza says it is still investigating the possibility of a data leak and has yet to establish the full extent of the intrusion.
- It has advised customers who reused their Iris Plaza passwords elsewhere to change them, presumably before someone else gets the opportunity.
- Iris Plaza immediately suspended its website and associated systems and began investigating, subsequently confirming unauthorized access.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 1 article from 1 outlet
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.