Iris Ohyama data cloud breach exposes info of 7.7 million customers

BleepingComputer

November 8, 2026 at 3:43 PM

Overview

Iris Ohyama, a Japanese company that runs the Iris Plaza shopping platform, has reported a data breach affecting approximately 7.7 million customers. The breach occurred due to unauthorized access to a third-party cloud service used by the company. Personal information that may have been compromised includes names, addresses, and possibly other sensitive details. This incident raises concerns about the security of third-party services and the vulnerability of customer data. Affected individuals should remain vigilant for potential identity theft or phishing attempts as a result of this breach.

Key Takeaways

Affected Systems: Iris Plaza shopping platform, third-party cloud service
Action Required: Users are advised to monitor their accounts and consider changing passwords.
Timeline: Disclosed on [date]

Original Article Summary

Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used. [...]

Impact

Iris Plaza shopping platform, third-party cloud service

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on [date]

Remediation

Users are advised to monitor their accounts and consider changing passwords. Companies should review their third-party service security protocols.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing, Vulnerability, Data Breach.

Read Original Article

Related Coverage

Google DeepMind’s AI Agents Make 1024-Bit RSA Keys Cheaper to Attack

SecurityWeek

Researchers at Google DeepMind have developed AI agents that can significantly reduce the cost associated with forging RSA-1024 signatures and factoring RSA-1024 keys. This breakthrough means that what was once a resource-intensive process can now be accomplished more cheaply, potentially making these cryptographic keys more vulnerable to attack. RSA-1024 is widely used for securing communications, so this development raises concerns about the integrity of data and systems relying on this level of encryption. If attackers can forge signatures or factor keys more easily, it could lead to unauthorized access to sensitive information. As organizations continue to depend on RSA encryption, this finding underscores the need for stronger cryptographic standards and practices.

Nov 9, 2026

Former OpenAI Engineer Pleads Not Guilty to Planting Covert Device in Executive Meeting Room

The Hacker News

Abdulrahman Alfozan, a former engineer at OpenAI, has pleaded not guilty to charges of secretly installing an audio recording device in the company's executive meeting room. This incident, which raises significant concerns about privacy and corporate espionage, took place in the company's San Francisco office. Alfozan, a Saudi national, was arrested last month and appeared in federal court to enter his plea. The case is set for a hearing on November 17, 2026, and if found guilty, he could face serious legal consequences. This situation underscores the potential risks of insider threats in tech companies, where sensitive discussions can be vulnerable to unauthorized surveillance.

Nov 9, 2026

U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses

The Hacker News

U.S. government agencies are alerting the public about ongoing attacks targeting industrial refrigeration and cold-chain monitoring systems. These attacks aim to disrupt services, create fire hazards, and result in inventory losses by exploiting vulnerabilities in unpatched or internet-accessible controllers. Attackers can remotely change settings, potentially forcing refrigeration units to heat continuously. This threat is particularly concerning for industries relying on precise temperature control, such as food storage and pharmaceuticals, as it can lead to significant financial losses and safety risks. Companies are urged to secure their systems by applying patches and ensuring their controllers are not accessible over the internet.

Nov 9, 2026

Hackers pull off $133 million French bank heist via service provider

BleepingComputer

Crédit Mutuel Arkéa, a French cooperative bank, was hit by a cyberattack that led to fraudulent transactions totaling approximately $133 million. The breach was carried out through a service provider, which allowed hackers to exploit vulnerabilities and siphon off funds. In response to the incident, the bank has suspended certain systems to investigate the breach and prevent further losses. This significant heist raises concerns about the security measures in place for financial institutions and the potential risks posed by third-party service providers. Customers and stakeholders are likely to be anxious about the safety of their funds and personal information following such a large-scale attack.

Nov 7, 2026

SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins

SecurityWeek

SonicWall has released patches for a significant vulnerability in its SonicOS software, identified as CVE-2026-19868. This flaw allows attackers with credentials from different login methods to bypass SAML (Security Assertion Markup Language) checks, including those that enforce multi-factor authentication (MFA). This means that unauthorized users could potentially gain access to VPN logins, posing a serious security risk for organizations relying on SonicWall's VPN services. The issue is particularly concerning because it undermines the effectiveness of MFA, a key security measure. Users of SonicWall products are urged to apply the latest patches to secure their systems against potential exploitation.

Nov 7, 2026

Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

The Hacker News

A recent report from software security company Apiiro has revealed that sensitive information, including passwords and API keys, is publicly accessible in 1,122 GitHub repositories. This issue arises from a feature in Claude Code, Anthropic's AI coding assistant, where users can opt to save commands by selecting 'Yes, and don't ask again.' Unfortunately, this also saves any included secrets, making them visible to anyone browsing these public repositories. This exposes developers and organizations to potential security risks, as attackers can easily access these credentials to compromise systems. The incident highlights the need for developers to be cautious when using AI tools and to implement better practices for managing sensitive information.

Nov 7, 2026