Millions of Records on One Contractor PC
A contractor endpoint can concentrate a customer database’s risk without anyone yet proving theft.
On 8 October 2026, Daiichi Kosho reported possible exposure after malware infected one Nippon Columbia Group employee PC.
About 8.724 million records were potentially exposed, not necessarily that many people. Customer fields include registered name, sex, date of birth, email address and telephone number; employee records are also included.
Keep possibility and proof separate
No leakage or misuse was confirmed. Passwords were excluded; no malware family or attacker was named.
A 9 October update opened a telephone line and repeated that misuse remained unconfirmed.
Investigation uncertainty should change the wording, not remove the need to act. Identity and contact details can make an impersonation attempt more convincing even without a password.
Verify the contact, not its confidence
Be cautious with unexpected email, texts and calls. Avoid unfamiliar links and attachments.
Open the service’s known website or app independently, or use a telephone number you already trust. Do not disclose a password, one-time code or card number to an inbound caller. If a message claims urgent account action is required, verify it through a separate channel.
Change credentials if you entered them after a suspicious message, followed a questionable sign-in link, or see evidence that an account was accessed.
Ask what the endpoint needed to retain
BlackTree’s operational assessment: endpoint protection and a retention policy answer different questions. Teams need to establish which data a contractor actually holds, why it is needed, who can reach it and when it should disappear.
Map exports and local copies, minimise supplied fields, set expiry controls, and test deletion evidence. Separate administrative access from bulk data handling. Agree isolation, scoping and notification responsibilities before an incident, not while an investigation is under way.
Incident closure should require evidence-backed scoping. Confirm what files were present, when they arrived, which processes and accounts could reach them, whether the device communicated externally, and whether the same data exists on other endpoints. A clean rebuild does not answer those questions.
These are controls to assess, not findings that this contractor lacked them. A later company notice, forensic report or regulator finding could change the incident assessment.
Related reading: why a familiar telephone number is not authentication.
Sources: Original incident notice, 8 October 2026; Telephone-line update, 9 October 2026.
