--- title: "Daiichi Kosho data at risk after NCG malware incident" description: "Daiichi Kosho reported approximately 8.724 million records at risk after malware infected an NCG employee computer." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-13" canonical_url: "https://www.ally.security/incidents/daiichi-kosho-ncg-malware-data-risk-2026" markdown_url: "https://www.ally.security/incidents/daiichi-kosho-ncg-malware-data-risk-2026.md" stix_url: "https://www.ally.security/incidents/daiichi-kosho-ncg-malware-data-risk-2026/stix.json" --- # Daiichi Kosho data at risk after NCG malware incident The confirmed malware incident put outsourced-work data at risk; external leakage remained unconfirmed. Last modified Oct 13, 2026 · 2 sources ## Summary - **Environment:** One NCG employee computer holding outsourced-work data - **Operational impact:** Affected computer isolated; no Daiichi system impact confirmed - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [Daiichi Kosho](https://www.dkkaraoke.co.jp/) disclosed malware on a computer at [Nippon Columbia Group](https://www.columbia.co.jp/). The computer temporarily held personal data for outsourced work. Its [Japanese notice](https://www.dkkaraoke.co.jp/news/newsletter/261008_2.html) says external leakage remained unconfirmed. [2](#source-2) ## Impact Approximately 8,724,000 records were potentially involved: 8,631,000 customer records after removing overlap and 93,000 employee records. This is a data-at-risk estimate, not confirmed theft or a unique-person count. Fields included names, sex, birth dates, email addresses and phone numbers; passwords were excluded. [2](#source-2) ## Timeline ### October 2, 2026 — Computer isolated NCG isolated the affected endpoint. [2](#source-2) ### October 5, 2026 — Daiichi Kosho informed Daiichi Kosho received NCG’s report. [2](#source-2) ### October 9, 2026 — Inquiry desk opened A [follow-up notice](https://www.dkkaraoke.co.jp/news/newsletter/261009_1.html) announced a dedicated freephone line. [1](#source-1) ### October 13, 2026 — Briefing updated This briefing was last reviewed and updated on October 13, 2026. ## Threat Group & Attack Vector Malware was identified on October 1–2. The disclosure does not establish its entry method or family. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response NCG reset credentials and commissioned forensic work. Daiichi Kosho said it would review vendor controls. [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Personal-information incident: dedicated inquiry desk update official · Daiichi Kosho · Oct 9, 2026 ### 委託先企業への不正アクセスに伴う個人情報漏えいのおそれについて official · Daiichi Kosho · Oct 8, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Daiichi Kosho data at risk after NCG malware incident: Computer isolated 2. **Occurred At · 100% confidence · current** Daiichi Kosho informed: 2026-10-05 3. **Occurred At · 100% confidence · current** Potential leakage disclosed: 2026-10-08 4. **Affected Organization · 100% confidence · current** Daiichi Kosho data at risk after NCG malware incident: Daiichi Kosho 5. **Resulted In · 100% confidence · current** Daiichi Kosho data at risk after NCG malware incident: Potential leakage disclosed 6. **Resulted In · 100% confidence · current** Daiichi Kosho data at risk after NCG malware incident: Potential data categories included names, sex, dates of birth, email addresses and telephone numbers; the company excluded passwords from the data at risk. 7. **Occurred At · 100% confidence · current** Dedicated inquiry desk opened: 2026-10-09 8. **Resulted In · 100% confidence · current** Daiichi Kosho data at risk after NCG malware incident: Malware was identified on one NCG employee computer on October 1–2; the computer temporarily held personal data for work outsourced by Daiichi Kosho. 9. **Resulted In · 100% confidence · current** Daiichi Kosho data at risk after NCG malware incident: Daiichi Kosho informed 10. **Resulted In · 100% confidence · current** Dedicated inquiry desk opened: Daiichi Kosho opened a dedicated freephone inquiry desk. 11. **Vendor Of · 100% confidence · current** Nippon Columbia Group Co., Ltd.: Daiichi Kosho 12. **Resulted In · 100% confidence · current** Daiichi Kosho data at risk after NCG malware incident: Dedicated inquiry desk opened 13. **Occurred At · 100% confidence · current** Computer isolated: 2026-10-02 14. **Resulted In · 100% confidence · current** Potential leakage disclosed: Daiichi Kosho published its notice while investigation continued. 15. **Affected Organization · 100% confidence · current** Daiichi Kosho data at risk after NCG malware incident: Nippon Columbia Group Co., Ltd. 16. **Resulted In · 100% confidence · current** Daiichi Kosho data at risk after NCG malware incident: Daiichi Kosho said external leakage and misuse had not been confirmed, although the possibility of leakage could not be excluded. 17. **Resulted In · 100% confidence · current** Daiichi Kosho data at risk after NCG malware incident: NCG reset credentials and commissioned forensic work; Daiichi Kosho said it had not confirmed impact to its own systems and would review vendor management. 18. **Resulted In · 100% confidence · current** Computer isolated: NCG isolated the affected employee computer. 19. **Resulted In · 100% confidence · current** Daiichi Kosho informed: NCG informed Daiichi Kosho of the incident. 20. **Resulted In · 100% confidence · current** Daiichi Kosho data at risk after NCG malware incident: The potentially affected data comprised approximately 8,724,000 records: 8,631,000 customer records after removing overlap, plus 93,000 employee records. These are records at risk, not confirmed theft or a unique-person count.