The exposed data originates from karaoke-related services, and the compromised records include details belonging to both customers and employees. The disclosure attributes the root cause to a malware infection at Nippon Columbia rather than at Daiichi Kosho itself, highlighting the supply chain risk that third-party contractors can introduce.

At this stage, the reporting does not provide a specific CVE ID or advisory identifier for the malware involved, so no such identifier can be referenced. Readers should treat the 8.7 million figure as the headline impact number and monitor official statements from both companies for further details on affected services and notification procedures.

• Root cause: malware infection at contractor Nippon Columbia
• Disclosing entity: Daiichi Kosho
• Records exposed: more than 8.7 million customer and employee records
• No CVE ID or advisory identifier was provided in the source reporting

Organizations that rely on third-party vendors for customer data processing should take this as a reminder to review contractor security requirements, data access scopes, and incident notification clauses in their agreements.

Source: BleepingComputer

Does your organization assess the security posture of third-party contractors that handle customer data, and how do you enforce it?