The Field Briefing — Issue #022 November 8, 2026 · From the Red Flag Cyber research desk

Next issue: The desk is watching whether Iris Plaza announces a reopening date for its suspended store — none has been announced — and for the final count of records actually exposed, which the company said on November 5 is still under investigation.

DEEP DIVE

Iris Plaza breach: personal information on about 7.7 million people may have been exposed through a cloud service, encrypted passwords included

The Short Version: Iris Plaza, Iris Ohyama's online store, said on November 5, 2026 that personal information on about 7.7 million people — about 5.8 million members and former members and about 1.9 million non-members — may have been viewed or taken from an external cloud service it uses, including names, addresses, phone numbers, email addresses, dates of birth and encrypted passwords. The company says credit card information was not stored in that service, and as of November 5 it had received no reports of misuse or financial loss tied to the incident. The exact number of records actually exposed is still under investigation.

What to do now: - If you have or had an Iris Plaza account, change the password if you have reused it on any other service, starting with the email account tied to it, and turn on two-factor authentication where it is offered. - The company warns customers to expect impersonation by email, text message, phone call, website and social media account; a genuine notification will never ask for a password, PIN or authentication code, so treat any message that does as a scam even if it quotes your real name or address. - Do not click links in unsolicited messages — go to the company's site by typing the address yourself. Because the store remains suspended with no reopening date announced, be wary of messages claiming an order, delivery or refund needs urgent action. - Watch bank and card statements as a routine precaution, even though the company says card information was not stored in the affected service.

Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/iris-plaza

RED FLAG OF THE WEEK

A message quoting your real name, address, phone number or date of birth is not proven genuine. That combination is exactly what may have been exposed in the Iris Plaza incident, and it is enough for a scammer to pose as Iris Plaza with a believable delivery, refund or account message. A genuine notification will never ask for a password, PIN or authentication code. Go to the company's website by typing the address yourself instead of using any link or number in the message.

Source: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/iris-plaza

This issue covers items published November 5, 2026.

WHAT YOU LEARNED TODAY

If you reused an Iris Plaza password anywhere else, change it starting with your email account and turn on two-factor authentication; and treat any Iris Plaza order, delivery or refund message that asks for a password, PIN or code as a scam, even if it quotes your real details.

Forward this to ONE person who needs it today

👍 Good / 😐 Just OK / 👎 Terrible

—

Red Flag Cyber research desk

Masked and alias email addresses are welcome — subscribe with whatever address you're comfortable with. We never sell your data.