Iris Ohyama is a large Japanese household goods manufacturer and retailer. It has disclosed that a third-party cloud service used by its Iris Plaza online store was accessed without authorisation, and that up to 7.7 million people may be affected.

The timeline is tidy by the standards of these things. A suspicious file was found in the third-party environment. The store and related systems were suspended on 28 October. Japan's Personal Information Protection Commission and the police were notified on 29 October. As of 5 November no misuse or financial loss had been reported and the perpetrators had not been identified.

The data may include names, addresses, phone numbers, email addresses, gender, dates of birth and account passwords. Credit card data was not held in the affected environment.

Two things in that disclosure are worth more attention than the headline number.

"An encrypted format"

The company says passwords for active members were stored in an encrypted format. It has not said which.

That phrasing is doing a lot of quiet work. Passwords should not be encrypted. They should be hashed, with a slow algorithm and a per-user salt, specifically so that nobody holding the database can recover the original. Encryption is reversible by design; that is what distinguishes it from hashing. A company that has hashed its passwords with bcrypt or argon2 almost always says so, because saying so is the one piece of good news available on a day like this.

There are three readings. The passwords were properly hashed and whoever wrote the notice used the wrong word, which is common. Or they were genuinely encrypted, in which case the question is where the key was and whether it was in the same environment. Or nobody writing the notice knows, which is its own answer.

The company's own advice resolves the ambiguity better than its description does: it told anyone who reused their Iris Plaza password elsewhere to change it immediately. That is what you say when the protection is not load-bearing.

The 1.9 million with nothing to reset

The 7.7 million splits into roughly 5.8 million current and former members and 1.9 million non-members.

The non-members are people who bought something without creating an account. Guest checkout. They have no login, no account page, no password to change, and in most cases no memory of having shopped there.

They are a quarter of the affected population and there is no mechanism to reach them. The company can email the members. It can force a password reset on the members. For the 1.9 million it can publish a notice and hope, and the people most likely to miss a notice on a retailer's website are precisely the people who never signed up for anything.

This is a structural gap in how breach notification works and it is getting worse, because guest checkout is now the default experience on most retail sites. The organisation holds the data of people who have no relationship with it, and when the data moves, the relationship that does not exist is the one that would have been needed to tell them.

Anybody who bought from Iris Plaza as a guest has had their name, address, phone number and date of birth exposed, and the most likely way they will find out is an article like this one.

What is not established

  • Whether the passwords were hashed or encrypted, and with what.
  • Which third-party cloud service was involved, and how the attacker reached it.
  • Who the attacker is. The company says it has not identified them.
  • Whether 7.7 million is a ceiling or an estimate. Every account of this says "up to" and "may have been exposed".
  • What the non-member records actually contain, as against the member records.
  • Iris Ohyama's own notice in Japanese, which we did not read in the original. Everything here is from reporting of it.