Iris Ohyama breach: 7.7M shoppers' data in one cloud store

One file in a cloud service took a big online store offline for more than a week. In the Iris Ohyama data breach, someone got into an external cloud service used by Iris Plaza, the Japanese home-goods maker's official online store. The company says personal data on about 7.7 million people may have been viewed or taken. About 1.9 million of them never made an account. They checked out as guests or entered a giveaway.

What actually happened

Iris Plaza Co., the Sendai-based group company that runs the store, gave these facts in its second notice, dated November 5 (Japanese). BleepingComputer reported it on November 8.

• The trigger. On October 28 the company found a suspicious file in an external cloud service it uses. It shut down the Iris Plaza store and related systems the same day. It confirmed third-party access and reported it to police and Japan's Personal Information Protection Commission on October 29.
• Members (about 5.8 million, including former members). Name, address, phone, email, gender, date of birth and password. Former members' passwords were not stored.
• Non-members (about 1.9 million). Name, address, phone and email from guest purchases and campaign entries.
• Not affected. Card data was not stored in that cloud service. The company found no breach at Iris Plaza's stores on outside marketplaces.
• Collateral. The SIMPLE STYLE home store and Iris Tech Service's appliance subscription and delivery sites also went offline on October 28. As of November 5, there was no reopening date and no reported misuse.

The notice says some fields, passwords included, were encrypted. It does not name the method. The company has asked customers to change the password anywhere they reused it, and to watch for phishing that pretends to be Iris Plaza.

Why the Iris Ohyama breach matters for your business

Three lessons, at any store size:

1. Guest and giveaway data is still breach data. A quarter of the exposed records came from people who never signed up. If you keep every contest entry and guest order forever, you keep that risk forever. Set a retention period and delete on schedule.
2. Don't store cards. Let the processor hold them. Card data wasn't in this cloud service, so it wasn't in this breach. Tokenized payments through Stripe, Shopify Payments or your processor keep card numbers off your systems.
3. Your marketplace storefronts are a backup channel. The company says its stores on outside marketplaces showed no breach so far. A shop that sells only through its own site has nothing to fall back on when that site goes down.

Also check where your customer data copies end up: exports, analytics tools, email platforms, the "temporary" bucket. Each copy is another place that can be breached.

Sources: Iris Plaza second notice (Japanese), BleepingComputer.