Iris Ohyama, the company behind the Iris Plaza online store, says data on up to 7.7 million people may be out. Card numbers were not in the affected service.
Iris Ohyama, a big Japanese maker of household goods, says personal information on about 7.7 million people may have been exposed. A third party got into an outside cloud service that the company's Iris Plaza online store used. The company says it has no reports of misuse so far.
The company found a suspicious file in the external cloud service late last month. It shut down Iris Plaza and related systems on October 28 and began an investigation. It confirmed that an unauthorized party got in, and it told Japan's privacy regulator and police on October 29.
The investigation says customer data stored in that service may have been accessed. The company is still working out how many records and how many people are affected. The 7.7 million figure is a ceiling, not a final count.
Up to 5.8 million current and former Iris Plaza members are included, along with up to 1.9 million people who shopped without an account. Sites for Iris Tech Service Co., which runs services such as appliance subscriptions and furniture and appliance delivery and installation, were also suspended.
Iris Ohyama makes storage units, LED lighting, home appliances and garden accessories. Iris Plaza is its online storefront.
The company says credit card details were not stored in the affected cloud service. It also says passwords for active members are kept in encrypted form, though it did not say what kind of encryption it uses. Former members have no passwords stored at all. What data was exposed differs from person to person.
Anyone who never dealt with Iris Plaza or Iris Tech Service has no obvious reason to worry about this one.
Names and contact details can be enough for a convincing scam. A fake message about an order, a delivery or an account problem looks real when it uses facts the sender should not know. That is the main risk here, even without card numbers.
The alert box above lists the steps to take. They come down to securing your account and being wary of any message that mentions Iris Plaza.
The company has not identified who is behind the attack. A spokesperson told BleepingComputer it has had no direct contact from the attacker, so it is unclear whether a ransom has been demanded. As of November 5, it had seen no reports of misuse or financial loss. Final numbers and further details are still to come.
If you have ever shopped at Iris Plaza, secure your account and treat any message about an order with suspicion.
Scammers are emailing Humboldt County well permit applicants and demanding $5,960 before a permit is issued. The county says the fee is fake.
Read more: Fake County Emails Demand $5,960 Fee for Well PermitsCallers posing as the Sheriff's Office told a Sarasota County woman she missed jury duty. She lost over $40,000, and the same scam is hitting others.
Read more: Fake jury duty calls cost one Florida woman over $40,000Europol warns that scam callers can fake the number on your screen, so the safest move is to hang up and call back using a number you found yourself.
Read more: Got a suspicious call? Hang up and look up the number yourself
