[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP-0SOEovecdCjObWfUQVQtaBJScH66DHg3630bMe8rM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"8aa310e7-db12-47a2-8f2d-0ff2a7196ecd","iris-plaza-cloud-breach-exposes-77-million-customers-via-third-party-service","19660735-b718-4f4f-8215-86fb4b6d4ccc","Iris Plaza Cloud Breach Exposes 7.7 Million Customers via Third-Party Service","The Iris Plaza breach highlights the critical risk posed by third-party cloud services that store or process sensitive customer data. Attackers compromised an external cloud provider used by the platform, gaining access to personal information for millions of registered and non-registered users — data that organizations are ultimately responsible for protecting regardless of where it resides. The exposure of encrypted passwords, dates of birth, and contact details creates compounded risks including credential stuffing and identity fraud. This incident underscores that outsourcing data storage to cloud providers does not transfer accountability for data security, and that vendor security posture must be continuously evaluated.","**Immediate actions:**\n- Conduct an emergency audit of all external cloud services and third-party vendors that store or process customer personal data.\n- Force a password reset for all affected accounts and notify impacted customers promptly to reduce downstream harm from credential reuse.\n\n**Long-term improvements:**\n- Establish a formal Third-Party Risk Management (TPRM) program that requires vendors to meet minimum security baselines before onboarding and undergo periodic reassessment.\n- Apply data minimization principles by limiting what personal data is shared with or stored by external services to only what is strictly necessary.\n- Ensure password hashing uses modern, resistant algorithms (e.g., bcrypt, Argon2) with per-user salts so that encrypted\u002Fhashed credentials are not trivially reversible.\n\n**Detection measures:**\n- Require contractual obligations for external cloud providers to implement real-time security monitoring and mandatory breach notification within defined timeframes.\n- Implement continuous monitoring of data flows to and from third-party services to detect anomalous access or exfiltration activity early.",[12,13,14,15,16,17,18],"CIS Control 15: Service Provider Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIS2 Article 21(2)(b)","CIS Control 3: Data Protection","CIS Control 17: Incident Response Management",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"CIS Control 3: Data Protection":22,"CIS Control 15: Service Provider Management":23,"CIS Control 17: Incident Response Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Article 32 requires controllers and processors to implement appropriate technical and organizational measures to protect personal data, including when that data is processed by a third-party cloud service on behalf of the controller.","NIS2 explicitly requires organizations to address supply chain security risks, including the security practices of direct suppliers and service providers such as the external cloud platform compromised in this incident.","This control requires organizations to inventory, classify, and protect sensitive data regardless of where it resides, ensuring that customer PII stored in external cloud services is subject to the same protections as on-premises data.","This control requires organizations to establish and maintain an inventory of service providers and assess their security posture, which would have surfaced inadequate protections on the external cloud service before attackers exploited it.","A well-defined incident response plan covering third-party breaches would have enabled faster containment and customer notification after the October 28 discovery, reducing the window of harm for affected individuals.","This control mandates identifying and remediating technical vulnerabilities in systems used by the organization, including those operated by external cloud providers handling organizational data.","Proper access controls governing who and what systems can access customer data stored in third-party cloud environments would have limited the attacker's ability to reach and exfiltrate 7.7 million records.","published","2026-11-09T13:20:40.583774+00:00","2026-11-09T13:20:40.563+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.securityweek.com\u002Firis-plaza-breach-may-have-exposed-data-of-7-7-million-customers\u002F","iris-plaza-breach-may-have-exposed-data-of-7-7-million-customers-b475f3","Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":54,"name":55,"problem":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":58,"name":59,"problem":60},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]