Nippon Columbia Malware Infection May Have Exposed 8.7 Million Customer Records

Nippon Columbia Group disclosed a malware infection on October 8, 2026, that may have exposed millions of Daiichi Kosho customer and employee records after a contractor’s employee computer was infected.

Daiichi Kosho says data theft and misuse remain unconfirmed, and it has found no impact on its own systems. The estimated total is 8.724 million records, comprising approximately 8.631 million customer records and 93,000 employee records.

Although the headline rounds the figure to 8.7 million customer records, the full count includes both groups. These figures describe records potentially at risk, not a confirmed number of people whose information was stolen.

Nippon Columbia Group handles personal information on behalf of Daiichi Kosho. According to the company’s initial incident notice, the infected computer temporarily stored personal data linked to this work was temporarily stored on the infected computer. Investigators could not rule out the possibility that information had leaked outside the organization.

BleepingComputer reported that Nippon Columbia notified Daiichi Kosho on October 5 and isolated the affected computer the following day. The contractor also reset passwords and other login credentials while investigating the cause, scope, and possible online release of data.

Nippon Columbia Malware Infection Exposed

The available reporting does not identify a malware family, name an attacker, or explain how the computer became infected. It also provides no technical evidence showing that files were copied outside the network. Those gaps mean the incident should not be described as confirmed ransomware activity or a proven data theft operation.

The affected information may include registered names, gender, dates of birth, email addresses, and telephone numbers. Customers of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining may be affected. The records relate to people who registered as members or made reservations through the company’s services.

Daiichi Kosho says passwords are not included in the potentially exposed information. It has also reported no evidence of unauthorized use of loyalty points.

Customers should nevertheless remain cautious about unexpected emails, text messages, or calls asking for payment or personal and financial details.

The case highlights a risk linked to outsourced data handling. Daiichi Kosho’s own systems need not be compromised for a contractor’s information to be exposed.

Related CybersecurityNews coverage of the Veradigm third-party data breach and Fidelity Investments vendor incident offers further context on how incidents at service providers can affect their clients. These are separate cases, not evidence of a shared attacker.

In its October 9 update, Daiichi Kosho announced a dedicated toll-free inquiry hotline at 0120-732-079. The service operates from 10:00 a.m. to 5:00 p.m., excluding Saturdays, Sundays, and public holidays. Customers unable to reach the company by phone can email [email protected].

The company apologized again for the concern and inconvenience caused. It said it had not confirmed any unauthorized use of personal information arising from the incident, but the investigation remained ongoing. Daiichi Kosho will continue working with relevant authorities to establish the cause and prevent a recurrence.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Nippon Columbia Malware Infection May Have Exposed 8.7 Million Customer Records appeared first on Cyber Security News.