Security NEXT, note and SecurityWeek reported a data breach at Iris Plaza (Japan) on 2 November 2026. It affected 7,700,000 people.
What we know as of
Status
Reported by Security NEXT, note and SecurityWeek; not yet confirmed by Iris Plaza or an authority.
People affected
7,700,000 people.
What was exposed
Passwords and logins, Email addresses, Phone numbers, Dates of birth, Names, Addresses and Gender.
When
First reported 2 November 2026.
How
Misconfiguration, through external cloud service.
Iris Plaza’s record
No earlier breach on record under this name.
Not known yet: when it began and who was behind it. This page is updated as notices and statements come in.
Every fact above has its source below. Journalists: free to quote with credit (“Privacy Unpacked data breach tracker”, with a link to this page and the date); the figures can move. Follow this breach (feed) · Every major breach · Ask us for a figure
People affected
7,700,000people
Reported
2 November 2026News report and 2 more
What was exposed 7
Passwords and logins
Email addresses
Phone numbers
Dates of birth
Names
Addresses
Gender
How it happened
How
Data left open (misconfiguration) Personal data of approximately 7.7 million people stored in an external cloud service may have been leaked.sourceOur translation from Japanese外部クラウドサービスに保存していた約770万人分の個人データが、漏えいした可能性があるというのです
Way in
external cloud service An external cloud service was breachedsourceOur translation from Japanese外部クラウドサービスが侵害を受け
News reports are read by an AI model; every fact taken from an article was checked word for word against it, and anything it could not find was dropped. · Corrections and changes
Questions about the Iris Plaza breach
Was Iris Plaza hacked?
Security NEXT, note and SecurityWeek reported a data breach at Iris Plaza (Japan) on 2 November 2026. It affected 7,700,000 people. How it happened, by the sources: misconfiguration, through external cloud service. It has been reported but not confirmed by Iris Plaza or an authority.
What data was exposed in the Iris Plaza breach?
Passwords and logins, Email addresses, Phone numbers, Dates of birth, Names, Addresses and Gender, by the notices and reports on this page.
How do I know if I was affected?
Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.
Is there a Iris Plaza data breach settlement?
No settlement open for claims is on record for Iris Plaza as of 15 November 2026. Every open settlement is listed with its deadline.
Is a letter, email or text about the Iris Plaza breach real or a scam?
A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to Iris Plaza’s own site, or check the letter here.
Privacy Unpacked