Iris Ohyama, the Japanese manufacturer behind the Iris Plaza online shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used.

The company discovered a suspicious file in the external cloud service used by its Iris Plaza online store, immediately suspended the platform and related systems, and confirmed unauthorized access by a third party, which it first disclosed on October 29.

According to BleepingComputer, the impact extends to up to 5.8 million registered and former members plus 1.9 million non-members, and the exposed data can include full names, addresses, phone numbers, email addresses, gender, dates of birth and account passwords.

The details matter because of what was and was not stored in the compromised service.

BleepingComputer reports that Iris Plaza stores passwords for active registered members in encrypted form, though the company did not specify which encryption scheme it uses, and that no passwords are stored at all for former members.

As of November 5, the company said it had received no reports of misuse of the exposed information or financial loss tied to the incident, and a spokesperson told BleepingComputer that it has received no direct communications from the attacker or identified the perpetrators.

The same week, Aju Press reports that SM Entertainment and two affiliates — DearU, operator of the Bubble fan platform, and concert producer Dreammaker Entertainment — suffered a breach around Nov.

4 in which an attacker accessed internal systems including an electronic document approval platform and extracted files containing resident registration numbers, bank account details and contract records.

The parallel shows the pattern behind both incidents: attackers are reaching sensitive records through business systems and third-party services rather than customer-facing front ends.

The company says passwords were encrypted and card data untouched, but exposed names, addresses, phone numbers and dates of birth are still enough to fuel convincing phishing and impersonation scams — a risk SM Entertainment explicitly warned its own customers about while it notifies affected individuals by email or text.

For readers, the takeaway is to treat any message referencing Iris Plaza, Iris Ohyama or the suspended SIMPLE STYLE store with suspicion and to change reused passwords, even in encrypted form. The open questions: who the perpetrators are and whether any ransom demand follows.