Cloud breach may expose data tied to 7.7 million shoppers
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Monday, November 9th, 2026.
Personal information tied to as many as 7.7 million people may have been exposed after unauthorized access to a cloud service used by the Iris Plaza shopping platform. The potential total includes 5.8 million registered or former members and 1.9 million non-members.
The operator suspended the store and related systems after finding a suspicious file. Credit card information wasn’t stored in the affected service. As of November 5th, the company had received no reports of related misuse or financial loss. Passwords for active members were stored in encrypted form, although the encryption method wasn’t disclosed.
For leaders, the important point is that retention and vendor decisions determine the possible size of a breach before an attacker arrives. For defenders, confirm what information sits in each external service and whether the available access logs can support a fast investigation. Cloud responsibility still requires data minimization, strong access control and evidence readiness.
Map customer data held in external cloud services and remove records that no longer have a justified business or legal purpose.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
