The retailer, which sells everything from home appliances and furniture to pet supplies, first disclosed the incident on October 29, a day after discovering a suspicious file on a third-party cloud service used by its Iris Plaza ecommerce operation. Iris Plaza immediately suspended its website and associated systems and began investigating, later confirming unauthorized access. Iris Ohyama has since revealed that the potentially compromised cloud environment contained personal information belonging to about 5.8 million registered customers, including former members, and another 1.9 million people who had purchased products without creating an account or participated in promotional campaigns.
The potentially exposed information includes names, addresses, phone numbers, email addresses, dates of birth, gender, and passwords, although the company says the exact information at risk varies between customers. Some of that data, including passwords, was encrypted, but Iris Ohyama hasn't explained what protection was used.
