Iris Plaza says about 7.7 million customer records may have leaked

Iris Plaza says personal data stored for about 7.7 million people may have been viewed or taken. The November 5 notice is from Iris Plaza Co., the Iris Ohyama group company that runs the Iris Plaza online store. It says the actual number of leaked records, and the number of people affected, is still under investigation. It also says it has no reports of misuse or financial loss tied to the incident.

The company found a suspicious file on October 28. It says it stopped Iris Plaza and related systems that day and started an investigation. It confirmed unauthorized access by a third party and posted a first notice on October 29. A later check found that data kept in the outside cloud service may have left the service.

The November 5 breakdown has two groups. Member data, including former members, covers about 5.8 million people and can include names, addresses, phone numbers, email addresses, gender, passwords and dates of birth. Non-member data covers about 1.9 million people and can include names, addresses, phone numbers and email addresses. The notice says not every field applies to every person. Some fields, including passwords, are encrypted. Former members' records do not include passwords.

Credit card data was not in the affected service. Iris Plaza says it confirmed that card details were not stored there and were not affected. It also says it has not confirmed unauthorized access or a leak at its stores on other online malls.

Police and the privacy regulator were told on October 29. The company says it will email affected customers individually, and that those messages will not ask for a password, a PIN, an authentication code, or for those details to be entered through a link. Iris Plaza has not set a date to reopen. The Simple Style site, and Iris Tech Service sites for appliance subscriptions and delivery, have been stopped since October 28. The notice says those Tech Service sites have not shown unauthorized access or a leak.