"Personal data related to work outsourced to us was temporarily stored on the device in question, and we cannot rule out the possibility that this data may have been leaked."
How the infection was discovered at Nippon Columbia Group
Daiichi Kosho published a statement on October 8 saying the company was notified by Nippon Columbia Group (NCG) that "between October 1 and October 2, 2026, a malware infection was discovered on one of their employees' devices (a PC)," and that the device was isolated from the network on October 2. Daiichi Kosho said it received NCG's report on October 5. NCG has reset affected passwords and is investigating both the cause and whether data were actually exfiltrated.
Scope of the potential exposure and the brands affected
Based on information "we currently have," Daiichi Kosho warned that approximately 8,724,000 customers who registered or made reservations at its stores may have had personal information exposed. The firm listed the data elements that may have been leaked as registered names, genders, dates of birth, email addresses, and telephone numbers.
The majority of potentially impacted customers are patrons of Big Echo (5.6 million) and the company's DK Dining brands (3.5 million). Daiichi Kosho also named Mega Big, Banana Club, Karaoke Club Dam and B-Garage among the affected businesses.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCorporate response: mitigation steps and customer guidance
Daiichi Kosho said NCG has taken immediate containment steps, including isolating the infected device and resetting affected passwords. The company has opened a toll-free number for concerned customers while it confirms what happened. Daiichi Kosho urged customers to be vigilant for phishing, specifically warning: "Please be extremely careful of suspicious emails, SMS messages and phone calls, and do not open any links or attachments that you do not recognize." The company added plainly, "We will never ask you for your password or credit card information."
Recent cyber incidents in Japan that form the backdrop
The disclosure comes amid a run of cyber incidents in Japan. In September, Tokyo Metro said an unauthorized third party accessed the email addresses of 59,000 passengers in its Metpo loyalty scheme. Around the same time Keio Corporation reported a ransomware attack, although it was not clear whether any data were compromised. Times Car announced on September 25 that an unauthorized third party had accessed its website, leading to the compromise of personal information on 6.6 million members and former members. The statement also recalled that last year a major ransomware attack on Asahi Group Holdings severely disrupted operations.
The statement notes broader structural challenges: "Japan has long been playing catch up on cybersecurity, due partly to chronic skills shortages and poor governance." It also points to a legal change: a new Active Cyber Defence law that came into force on October 1 will empower the Self Defense Forces (SDF) and police to proactively access and neutralize hostile foreign servers, but the statement cautioned that the law "may do little to improve cybersecurity posture in regular organizations, especially SMBs."
How customers, Daiichi Kosho/NCG, and Japanese authorities are responding
- Customers: Daiichi Kosho has advised vigilance for phishing by email, SMS and phone, and has opened a toll-free number for inquiries. The firm has asserted it will not request passwords or credit card information.
- Daiichi Kosho and NCG: NCG isolated the infected PC, reset affected passwords and is investigating the cause and whether data were exfiltrated. Daiichi Kosho is confirming the scope and notifying potentially affected customers.
- Japanese authorities and public policy: The new Active Cyber Defence law, effective October 1, expands powers for the SDF and police to act against hostile foreign servers; the disclosure notes those powers may not directly strengthen cybersecurity practices in ordinary businesses and small-to-medium sized firms.
The record from Daiichi Kosho and NCG is clear on what is known and what remains uncertain: the infected device was isolated and passwords were reset, but the firms "cannot rule out the possibility" that personal data were leaked and the investigation is ongoing. For more than 8.7 million customers the immediate practical consequence is heightened exposure to targeted phishing using names, birthdates, email addresses and telephone numbers. For businesses and policymakers the episode is another data point in a sequence of high-profile incidents that, according to the statement, underscores persistent workforce and governance shortfalls — and raises the question of whether legal tools aimed at external threats will translate into stronger protection inside commercial supply chains.
