A PC at a contractor for Daiichikosho has been infected with malware, raising the possibility of a leak of approximately 8.72 million pieces of personal information, including membership data for Big Echo and other services. In the background are the operational risks of temporarily storing data on contractor-managed devices outside of the company’s internal systems, alongside the persistent threat of successive supply chain attacks.

Infection of a Contractor’s PC and Details of the Affected Data Totaling Approximately 8.72 Million Records

On October 8, 2026, Daiichikosho Co., Ltd. announced that at Nippon Columbia Group Co., Ltd., to which the company outsources the handling of personal information, a PC used by an employee was infected with malware, creating the possibility that a total of approximately 8,724,000 pieces of customer and employee personal information may have been leaked externally. A breakdown of the data at risk of leakage shows that approximately 8,631,000 records are customer information from store membership registrations and reservations, and approximately 93,000 records are employee information. The target brands for the customer information span a wide range, with Big Echo karaoke store-related data accounting for approximately 5,558,000 records and DK Dining restaurant brand-related data accounting for a majority at approximately 3,462,000 records. In addition, the data includes Karaoke CLUB DAM (approx. 74,000 records), MEGA BIG (approx. 43,000 records), Banana Club (approx. 5,000 records), and B-GARAGE (approx. 4,000 records), which is calculated by subtracting approximately 515,000 duplicate records. The targeted items consist of five categories: name (registered name), gender, date of birth, email address, and phone number. On the other hand, various login passwords, credit card information, and bank account information are not included, and it has been explained that there is no concern of unauthorized use of points using this information alone. Please refer to the figure below.

Why It Remains a “Potential Leak”: Infection Mechanism and Investigation Status

An important point in this announcement is not that Daiichikosho itself has confirmed a “data leak,” but rather that it disclosed the incident as a “risk (possibility) of a leak.” According to a report from its contractor, the Nippon Columbia Group, malware was detected on a single employee terminal between October 1 and October 2, 2026, and the device was immediately isolated from the network as of October 2. Subsequently, it was discovered that customer data related to the outsourced operations was temporarily stored on the PC, and the situation was reported to Daiichikosho on October 5. In this incident, no direct intrusion or tampering with Daiichikosho’s own servers or core systems has been confirmed. However, because the possibility that the malware communicated externally with the data temporarily stored on the infected terminal cannot be completely ruled out, the possibility of a leak was disclosed out of an abundance of caution. At present, investigations by external expert organizations are ongoing, and no direct traces indicating unauthorized data use or actual leakage by third parties have been confirmed. Daiichikosho is taking steps to urge users to be cautious by promptly disclosing the details, including the breakdown, even at a stage where definitive evidence is lacking.

Recent Supply Chain Attacks and Their Impact on Corporate Management

Structural Challenges of Third-Party Risk via Contractors

Even if a company’s own security measures are robust, “supply chain attacks”—in which the devices of outsourced external partners and suppliers serve as entry points—are becoming increasingly serious in Japan. In the “Information Security 10 Major Threats 2026” published by the IPA (Information-technology Promotion Agency, Japan), “attacks targeting supply chains and outsourced vendors” was ranked as the second-largest threat to organizations, and it has been guarded against as a top-level risk for many years. Looking at past domestic cases, a ransomware attack on the printing and mailing contractor ISETO in May 2024 resulted in secondary damage, with approximately 1.5 million pieces of personal information leaked from client local governments and corporations. In addition, there has been a succession of cases in which compromises exploiting the vulnerabilities of vendors and third parties have paralyzed corporate activities, such as the cyberattack on the KADOKAWA Group in June 2024 and the factory shutdown incident caused by an intrusion into a primary supplier of Toyota Motor in 2022. This has highlighted the structural risk in which temporary files and data lists output to local devices for operational convenience are targeted, bypassing the advanced defense measures of the main company. Please refer to the figure below.

Spillover Effects on the Stock Market, Financials, and Consumer Confidence

The occurrence of cyber incidents has a wide-ranging impact on a company’s social credibility, stock price, and financial foundation. According to data from the JCIC (Japan Cybersecurity Innovation Committee) investigating 47 domestic companies that made timely disclosures, it has been confirmed that stock prices decline by an average of 6.3% 50 days after a timely disclosure regarding unauthorized access and other incidents. This is because market participants are concerned about the risk of deteriorating business performance due to forensic investigation costs, recurrence prevention measures, and the stagnation of sales activities. Looking at the stock market trends of Daiichikosho (TSE Prime: 7458), its stock price on October 9, 2026, the day following the announcement, saw only a minor fluctuation with a closing price of 1,713.5 yen (down 0.38% from the previous day). Regarding investor sentiment on financial bulletin boards (such as Yahoo! Finance), views have been expressed that the absence of leaked passwords or payment information, and the fact that the damage was not directly to its own servers, helped curb severe panic selling. However, on the other hand, due to the possibility that combinations of names, phone numbers, and email addresses may have been leaked, there are concerns about secondary risks such as phishing scams and spoofed SMS attacks targeting users, making an impact on the long-term brand image and customer trust unavoidable.

Defensive Measures Required for Enterprises and the Future of Governance

Trends in the Personal Information Protection Act and Government and Administrative Regulations and Guidance

Legal regulations and administrative guidance regarding corporate external vendor management are rapidly tightening. Article 25 of the Act on the Protection of Personal Information (APPI) stipulates that businesses outsourcing the handling of personal data have an obligation to exercise necessary and appropriate supervision to ensure security management at the outsourced destinations. In response to a succession of large-scale information leak incidents, the Personal Information Protection Commission (PPC) issued an emergency alert to businesses on October 7, 2026, calling for a re-confirmation of technical security management measures such as thorough access control and log monitoring. Furthermore, the Ministry of Economy, Trade and Industry (METI) and IPA are advancing the development of the “SCS Assessment System (Security Measure Evaluation System for Strengthening the Supply Chain)” to visualize and evaluate security standards across the entire supply chain, with a policy to sequentially launch a rating system based on self-assessments with expert verification and third-party evaluations. Guidelines from the Financial Services Agency and IPA also strongly demand the regular evaluation and contract management of third-party risks—extending beyond the company’s own organization—as a key management issue. Please refer to the figure below.

Stricter Vendor Management: Future Outlook and Key Points to Watch

We will outline the recurrence prevention measures that Japanese companies, starting with Daiichikosho, should take, as well as the trends that users should pay attention to. Fundamental measures required of companies include introducing data access designs that prohibit the local storage of customer data on subcontractor terminals, mandating encryption for business terminals, and thoroughly implementing EDR (Endpoint Detection and Response) and multi-factor authentication. In addition, it is essential to eliminate ambiguous operations such as “deletion after work completion,” build systems that automatically delete data when expiration dates are reached, and establish an audit system to regularly monitor the security management status of subcontractors. On the other hand, as a defensive measure for consumers using the service, it is important to maintain a cautious stance by not carelessly opening links in suspicious emails or SMS messages purporting to be from Daiichikosho or Big Echo. Future attention will focus on the announcement of final investigation results by external specialized institutions, specific measures by Daiichikosho to strengthen its subcontractor supervision system, and the direction of industry-wide governance reforms to prevent similar incidents.

Reference page

• [Regarding the Potential Leakage of Personal Information at an Outsourced Vendor – Daiichikosho Co., Ltd.] https://www.dkkaraoke.co.jp/news/newsletter/261008_2.html
• [Regarding measures that should be promptly implemented in light of incidents such as leaks due to unauthorized access – IPA] https://www.ipa.go.jp/security/security-alert/2026/alert20261009.html
• [Regarding Measures Based on Large-Scale Data Breach Incidents (Call for Attention) – Personal Information Protection Commission] https://www.ppc.go.jp/files/pdf/261007_houdou.pdf
• [Cybersecurity Management Guidelines – Ministry of Economy, Trade and Industry] https://www.meti.go.jp/policy/netsecurity/mng_guide.html

【#Daiichikosho #DataBreach #Cybersecurity #SupplyChainAttack #PersonalDataProtection #RiskManagement #BusinessNews】