Iris Ohyama says data on about 7.7 million people may have been exposed

Japanese household goods manufacturer Iris Ohyama announced on November 5 that its online store suffered unauthorised access and that personal data on about 7.7 million people may have leaked, according to public broadcaster NHK.

According to BleepingComputer, citing the company's statement, the access affected an external cloud service used by the Iris Plaza store. The maximum scope is 5.8 million current and former members and 1.9 million non-members. The data that may have been exposed includes names, addresses, phone numbers, email addresses, gender, dates of birth and account passwords, the latter encrypted in the case of active members, without the company specifying the method. There was no card data in that service, according to the company.

The company suspended the store and related systems on October 28 and reported the matter on October 29 to Japan's Personal Information Protection Commission and the police. As of November 5 it had received no reports of misuse of the data, and a spokesperson told BleepingComputer that it has received no communication from the attackers and has not identified them.

Developing story: it remains to be known how many records were actually taken, because the company is still investigating, and its original statement could not be opened; the figures come from NHK and BleepingComputer.