An Ecommerce Cloud Breach, Plus 3 Tech Stories
An ecommerce cloud breach may have exposed millions of shoppers, autonomous security-testing systems were left open to the internet, and an Australian safety bill is raising hard questions about age checks and private communications. Here’s what changed, what’s still uncertain, and what deserves action.
The Iris Plaza data breach reached beyond registered customers
Japanese manufacturer Iris Ohyama says an outside cloud service used by its Iris Plaza store was accessed without authorization. The company found a suspicious file on October 28, shut down the store and related systems, and later determined that data in the cloud service may have been viewed or acquired.
The headline number is about 7.7 million records, but it needs a qualifier. That is the amount of personal data stored in the affected service, not a confirmed count of people whose information was stolen. The company is still determining the actual number. The potential pool includes about 5.8 million current and former members plus 1.9 million people who bought something without creating an account or entered a campaign. Depending on the person, the fields may include a name, address, phone number, email address, birthdate, gender, and password. Credit-card data wasn’t stored in the affected system. Iris says some fields, including current-member passwords, were encrypted, but it hasn’t named the method.
That distinction matters, but it isn’t a reason to shrug. Names, addresses, phone numbers, and order relationships give a scammer enough context to write a convincing delivery, refund, or account-warning message. Iris says it hasn’t confirmed misuse or financial loss. It also says its legitimate notices won’t ask for passwords, PINs, authentication codes, or entry of those details through an email or text link.
If you used Iris Plaza and reused that password elsewhere, change it on those other accounts now. Don’t wait for proof that your particular row left the system. Everyone else can take the broader lesson: a guest checkout doesn’t necessarily mean the store forgets you. Data minimization has to include old members, contest entries, guest purchases, and the copies sitting in outside services.
For an ecommerce operator, the incident is also a continuity problem. Iris Plaza, a home-furnishings store, appliance subscriptions, and delivery-installation signups were all suspended, even though Iris says some of those related services weren’t breached. The practical audit is not just “Do we have backups?” It is: which provider holds the customer data, who can access it, how long is it retained, and what can we still sell, fulfill, refund, or communicate if that provider has to be disconnected?
Backups & recovery
Backups are comforting right up until you need one. Raymond Tec helps small businesses build practical backup and recovery plans — including the decidedly unglamorous part where we make sure the thing can actually be restored.
An autonomous hacking tool was exposed by basic mistakes
Censys found 1,465 internet hosts running the ARTEX console, with roughly 815 appearing to be distinct deployments after removing two large groups of identical systems. ARTEX is an open-source, large-language-model-driven penetration-testing framework. A planner agent turns a goal into attack steps, worker agents run scanning and exploitation tools, and the system keeps exploring until it reaches the goal.
That can help an authorized tester cover more ground. It can also help an attacker move from reconnaissance to data theft with much less hands-on work. CrowdStrike and Microsoft previously connected ARTEX to attacks on South Korean financial organizations and ConnectWise customer environments. Censys is careful about an important point: an exposed ARTEX system isn’t proof that its owner is criminal. Many belong to legitimate testers.
The problem is that these consoles didn’t need to be public, and hundreds were reachable without a password. Censys also found 32 open directories on ARTEX hosts exposing exploit files, implants, shell history, SSH material, and operator data. Some installations sat beside conventional command-and-control tools. The AI is the interesting part, but the first failure is painfully ordinary: a powerful administrative system was put on the public internet without effective access control.
If a business or contractor uses autonomous security tools, inventory every deployment and remove direct public access. Put the console behind authenticated remote access, restrict who can reach it, and treat its task histories, target lists, captured traffic, model credentials, and test accounts as sensitive records. “It’s only a test tool” doesn’t make the data inside it pretend data.
Technical discovery & auditing
The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.
Australia’s safety bill hasn’t banned teenagers from Gmail
Google told an Australian Senate hearing that the proposed Digital Duty of Care could force age verification and lead services to block users under 18 from Gmail, messaging, and private file storage. Meta, TikTok, and Snap raised related concerns about intrusive monitoring and platforms removing too much material to avoid large penalties.
Those warnings deserve attention, but they are company interpretations of a bill still moving through Parliament. They aren’t a description of current law, and the bill doesn’t explicitly say “remove Gmail from teenagers.” It would require covered services, including social platforms, games, and AI chatbots, to take reasonable safety steps; protect minors from specified harms; improve complaint processes; and, for social media, offer a feed without algorithmic recommendations. Penalties could reach A$109.2 million. The House has passed it, but the Senate process is still underway.
The missing detail is how services would reliably know who is under 18 and what they would have to inspect. Age assurance can mean anything from a declared birthday to identity documents, facial estimation, or behavioral signals. Each method creates different errors and privacy costs. A safety duty can be worthwhile while its enforcement mechanism still needs scrutiny. For now, there’s nothing for users to change. Watch the Senate amendments and the eventual technical rules, not just the most alarming prediction from either side.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
Smart glasses record people who never chose the device
South Korea’s privacy regulator is preparing smart-glasses guidelines after reviewing devices that combine cameras, microphones, sensors, phone apps, AI models, and cloud services. Its central observation is easy to miss: the person wearing the glasses often isn’t the person whose face, voice, conversation, or surroundings are being collected.
A recording light helps, but only if other people can see it, understand it, and trust that it hasn’t been covered. The data path can be harder to see than the camera. A clip may move through a companion app, a manufacturer’s cloud, an outside AI provider, and a social platform, each with different rules for storage and model training.
The regulator’s advice is sensible even outside South Korea: review how the device and connected services use data, disable functions you don’t need, avoid wearing the glasses in restricted or sensitive places, tell nearby people when you’re recording, and stop if they object. For a workplace, clinic, school, or customer-facing business, set the rule before the glasses walk through the door. The awkward conversation is cheaper than discovering later that a private meeting became somebody else’s training data.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- Iris Ohyama: second notice on the Iris Plaza incident
- BleepingComputer: Iris Ohyama cloud breach reporting
- Censys ARC: ARTEX exposure research
- TechCrunch: publicly exposed ARTEX deployments
- Australian government: proposed Digital Duty of Care
- Reuters: platform testimony on the Australian bill
- South Korea PIPC: smart-glasses privacy analysis and guidance
- Related Raymond Tec News: a bank attack through a service provider
Photo by Kampus Production on Pexels.
