The company discovered the incident in late October, suspended its online store and related systems on October 28, and notified Japan's Personal Information Protection Commission and police on October 29. In an update this week it said it found a suspicious file in an external cloud service used by Iris Plaza, and the investigation confirmed that customer data stored there may have been accessed.
The scope is still being determined, but the company says it extends to up to 5.8 million current and former registered members and 1.9 million non-members. Data types vary per person. Passwords for active members were stored encrypted, with no detail on the scheme, and credit card data was not stored in the affected service. Websites for Iris Tech Service were also suspended.
As of November 5 there were no reports of misuse or financial loss. A spokesperson told BleepingComputer the attackers had not contacted the company and have not been identified. Store customers should change their password, especially if it is reused elsewhere, and watch for phishing messages impersonating the company.