Japanese entertainment group Nippon Columbia revealed on October 8, 2026, that a malware-infected device belonging to a contractor may have put millions of records linked to its client Daiichi Kosho at risk. The breach potentially exposed around 8.724 million records in total — nearly 8.631 million for customers and roughly 93,000 for employees. So far, there’s no confirmation that any information was misused or stolen.
While the incident affected the contractor’s computer, Daiichi Kosho maintains its internal systems were not compromised. The organization also stresses that these numbers represent records possibly exposed, not a tally of actual people whose personal data has been confirmed stolen.
What types of data were at risk
The potentially exposed information spans registered names, gender, birthdates, email addresses, and phone numbers — both customer and employee. Importantly, password data was not part of the compromised information. No breaches of loyalty program accounts or points have been detected, according to the company. Patrons of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining might be affected — particularly those who signed up for memberships or made reservations.
Response, investigation, and what remains unclear
Nippon Columbia informed Daiichi Kosho of the infection on October 5; the involved contractor isolated the compromised device the next day. Measures taken include resetting passwords and login credentials.
The public disclosure lacks several key technical details: the malware’s type, how it entered the system, who might be behind the incident, and whether any files were exfiltrated. Thus, calling it ransomware or categorically confirming data theft would be premature.
To support those worried, Daiichi Kosho has set up a dedicated toll-free hotline for inquiries. An email contact is also available. Formal apologies have been issued, while the investigation continues with authorities to identify root causes and prevent recurrence.
This incident underscores risks in third-party data handling: even if a company’s own network is secure, external partners can create exposure.
What it means:This event shines a spotlight on how vulnerable customer and employee data can become when contracting out services. Companies in tech, entertainment, hospitality, and beyond rely heavily on partners; any gap in their security practices becomes a liability downstream. Going ahead, stronger audits, clearer data-access policies, and faster incident detection need to be standard parts of vendor management. Watch how Daiichi Kosho tightens oversight, whether new regulatory pressure follows in its sector, and what this breach means for customer trust.
