2026 Iris Plaza — data leak; up to 7.7M shoppers (max)
Data compromised
About 5.8 million members including leavers: names, addresses, phones, emails, sex, dates of birth, encrypted passwords (leavers excluded from the password field). About 1.9 million non-members (guest checkout or campaign): names, addresses, phones, emails. Cards are not on that cloud and were not in this take. External mall stores not involved. 7,700,000 is 5.8M plus 1.9M.
Technical writeup
Second report 5 November 2026. First report 29 October was site-down only. Helpline 0120-108-824. SIMPLE STYLE and Iris Tech Service sites were stopped as a precaution; those two have no confirmed leak.
Root cause
Suspicious file on an external cloud service used by Iris Plaza, found 28 October 2026. Shop and related systems stopped the same day. Path unpublished. Police and PPC told 29 October. 7.7 million is the stored-file ceiling, not a confirmed unique take.