[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxiT3ki7QQK9B5pw2Xbi7xPk4qswFK8x_bKkaVL7Rd4U":3},{"article":4,"iocs":36,"watch_terms":37,"solutions":38,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"8ceb71d1-5aaf-486c-98c1-808c904f57ee","Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk","japanese-homeware-giant-pulls-online-store-after-cloud-breach-puts-7-7m-records-ccfef6","No reopening date as orders face delays and some customers are told to refuse deliveries to cancel purchases","Japanese homeware giant Iris Ohyama has taken its online store offline after a cloud breach potentially exposed the personal information of 7.7 million customers. The incident, discovered on October 29, involved unauthorized access to a third-party cloud service used for its Iris Plaza e-commerce operation. While payment information was not stored in the affected service, exposed data may include names, addresses, phone numbers, email addresses, dates of birth, and passwords.","Japanese retailer Iris Ohyama takes down online store after cloud breach exposes 7.7M customer records.","https:\u002F\u002Fwww.theregister.com\u002Fcyber-crime\u002F2026\u002F11\u002F09\u002Fjapanese-homeware-giant-pulls-online-store-after-cloud-breach-puts-77m-records-at-risk\u002F5308377","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5308391&width=800","2026-11-09T12:47:00+00:00","2026-11-09T13:00:18.671513+00:00",7,[17,20],{"name":18,"type":19},"Iris Ohyama","vendor",{"name":21,"type":22},"Iris Plaza","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,31],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[],[18,21],{"controls":39,"vendors":127},[40,69,98],{"slug":41,"name":42,"problem":43,"products":44},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[45,53,61],{"vendor_slug":46,"vendor_name":47,"vendor_logo":48,"product_slug":49,"product_name":50,"url":51,"description":52},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":70,"name":71,"problem":72,"products":73},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"slug":99,"name":100,"problem":101,"products":102},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",[],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":140},"iris-ohyama-cloud-breach-exposes-77m-customer-records-via-third-party-service","Iris Ohyama Cloud Breach Exposes 7.7M Customer Records via Third-Party Service","Iris Ohyama's breach stemmed from unauthorized access to a third-party cloud service, highlighting the inherent risks of delegating data handling to external vendors without adequate oversight. When customer data — including passwords and personal identifiers — is stored with a third party, the organization's security posture is only as strong as that vendor's. The exposure of 7.7 million records demonstrates that supply chain and cloud vendor risks must be treated with the same rigor as internal systems. Password exposure in particular compounds the harm, as customers frequently reuse credentials across services, amplifying the blast radius far beyond this single incident.",[133,134,135,136,137,138,139],"CIS Control 15: Service Provider Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"GDPR Article 32":141,"NIS2 Article 21(2)(b)":142,"NIST SP 800-53 SI-2: Flaw Remediation":143,"CIS Control 15: Service Provider Management":144,"CIS Control 17: Incident Response Management":145,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":146,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":147},"GDPR requires both controllers and processors to implement appropriate technical and organisational measures to protect personal data; the exposure of 7.7 million EU-reachable customer records signals a failure of those obligations at the processor (vendor) level.","NIS2 explicitly requires incident handling measures and supply chain security controls, both of which were implicated here — the breach occurred via a third-party supplier and required taking a critical digital service offline.","If the third-party cloud service was compromised via an unpatched vulnerability, this control's requirement to identify, report, and remediate flaws on a defined schedule would have reduced the attack surface.","The breach originated in a third-party cloud service; this control requires organizations to establish processes to evaluate and monitor the security practices of external service providers handling sensitive data.","Taking the entire online store offline reactively suggests the absence of a mature incident response plan; a pre-defined playbook for cloud breaches would enable faster, more targeted containment with less business disruption.","Ensuring the third-party cloud environment was free of exploitable vulnerabilities through regular assessments and patch oversight could have prevented or limited the unauthorized access.","Unauthorized access to the cloud service points to insufficient authentication or access control enforcement on the third-party platform, which this control directly addresses by requiring strict identity and access governance."]