[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ37OIGhUMX3jcAjdD4sUCpsbCyT2LJN0ddrP9efVnP4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"120bd531-8fb7-44eb-b75a-56dd0abce4c6","iris-ohyama-cloud-breach-exposes-77m-customer-records-via-third-party-service","8ceb71d1-5aaf-486c-98c1-808c904f57ee","Iris Ohyama Cloud Breach Exposes 7.7M Customer Records via Third-Party Service","Iris Ohyama's breach stemmed from unauthorized access to a third-party cloud service, highlighting the inherent risks of delegating data handling to external vendors without adequate oversight. When customer data — including passwords and personal identifiers — is stored with a third party, the organization's security posture is only as strong as that vendor's. The exposure of 7.7 million records demonstrates that supply chain and cloud vendor risks must be treated with the same rigor as internal systems. Password exposure in particular compounds the harm, as customers frequently reuse credentials across services, amplifying the blast radius far beyond this single incident.","**Immediate actions:**\n- Conduct a thorough audit of all third-party cloud services to inventory exactly what personal data is stored and under what access controls.\n- Force a password reset for all affected customers and notify them with clear guidance on credential reuse risks.\n- Revoke and rotate any API keys, service account credentials, or access tokens connected to the breached cloud environment.\n\n**Long-term improvements:**\n- Implement a formal Third-Party Risk Management (TPRM) program requiring vendors to meet minimum security standards before handling customer PII.\n- Enforce contractual obligations on third-party vendors to store passwords only as salted hashes and to minimize data retention to what is strictly necessary.\n- Apply the principle of least privilege to all cloud service integrations, ensuring no vendor has broader access to data than their function requires.\n\n**Detection measures:**\n- Deploy cloud-native activity monitoring and alerting (e.g., CSPM tools) to detect anomalous access patterns in third-party environments in near real-time.\n- Establish regular penetration testing and security assessments of third-party cloud integrations as part of vendor contract requirements.",[12,13,14,15,16,17,18],"CIS Control 15: Service Provider Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 15: Service Provider Management":23,"CIS Control 17: Incident Response Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"GDPR requires both controllers and processors to implement appropriate technical and organisational measures to protect personal data; the exposure of 7.7 million EU-reachable customer records signals a failure of those obligations at the processor (vendor) level.","NIS2 explicitly requires incident handling measures and supply chain security controls, both of which were implicated here — the breach occurred via a third-party supplier and required taking a critical digital service offline.","If the third-party cloud service was compromised via an unpatched vulnerability, this control's requirement to identify, report, and remediate flaws on a defined schedule would have reduced the attack surface.","The breach originated in a third-party cloud service; this control requires organizations to establish processes to evaluate and monitor the security practices of external service providers handling sensitive data.","Taking the entire online store offline reactively suggests the absence of a mature incident response plan; a pre-defined playbook for cloud breaches would enable faster, more targeted containment with less business disruption.","Ensuring the third-party cloud environment was free of exploitable vulnerabilities through regular assessments and patch oversight could have prevented or limited the unauthorized access.","Unauthorized access to the cloud service points to insufficient authentication or access control enforcement on the third-party platform, which this control directly addresses by requiring strict identity and access governance.","published","2026-11-09T13:20:21.878258+00:00","2026-11-09T13:20:21.863+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.theregister.com\u002Fcyber-crime\u002F2026\u002F11\u002F09\u002Fjapanese-homeware-giant-pulls-online-store-after-cloud-breach-puts-77m-records-at-risk\u002F5308377","japanese-homeware-giant-pulls-online-store-after-cloud-breach-puts-7-7m-records-ccfef6","Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":54,"name":55,"problem":56},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":58,"name":59,"problem":60},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]