A contractor endpoint can concentrate a customer database's risk without anyone yet proving theft. On 8 October 2026, Daiichi Kosho reported possible exposure after malware infected one Nippon Columbia Group employee PC. About 8.724 million records were potentially exposed, not necessarily that many people. Customer fields include registered name, sex, date of birth, email address and telephone number; employee records are also included. Keep possibility and proof separate No leakage or misuse was confirmed. Passwords were excluded; no malware family or attacker was named. A 9 October update opened a telephone line and repeated that misuse remained unconfirmed. Investigation uncertainty should change the wording, not remove the need to act. Identity and contact details can make an impersonation attempt more convincing even without a password. Verify the contact, not its confidence Be cautious with unexpected email, texts and calls. Avoid unfamiliar links and attachments. Open the service's known website or app independently, or use a telephone number you already trust. Do not disclose a password, one-time code or card number to an inbound caller. If a message claims urgent account action is required, verify it through a separate channel. Change credentials if you entered them after a suspicious message, followed a questionable sign-in link, or see evidence that an account was accessed. Ask what the endpoint needed to retain BlackTree's operational assessment: endpoint protection and a retention policy answer different questions. Teams need to establish which data a contractor actually holds, why it is needed, who can reach it and…