Malware on a Daiichikosho Contractor's PC (About 8.72 Million Records): Big Echo and Other Members' Names, Birth Dates and Phone Numbers May Have Leaked — What to Do

According to the company, the data concerns customers who registered as members or made reservations at its stores. The breakdown is below. All figures are approximate, and duplicates (about 515,000) are removed from the total.

• Big Echo-related: about 5,558,000
• DK Dining-related: about 3,462,000
• Karaoke CLUB DAM-related: about 74,000
• Mega Big-related: about 43,000
• Banana Club-related: about 5,000
• B-GARAGE-related: about 4,000

In addition, about 93,000 employee records are included. The notice does not say whether this covers only current staff or former staff as well.

As of October 10, the notices do not say whether affected people will be contacted individually or how to check whether you are included. If you have ever registered or booked with any of the brands above, assume you are included and follow the steps below.

The company warns that, if the data did leak, it could be used for spoofed emails and phishing. It asks people to watch for suspicious emails, texts and calls and not to open unfamiliar links or attachments.

Karaoke and restaurant membership programmes routinely send coupons, membership-tier notices and points reminders. That makes fake "claim your coupon", "update your membership" or "points expiring" messages hard to tell apart from the real ones. Do not open the link; check whether the same notice appears in the official app or on an official site you bookmarked yourself (how to spot fakes: What is phishing?).

The company says it will never ask for passwords or credit card details. Do not respond to messages that ask for them in the name of an apology, compensation or bonus points. If you have already entered them, change the password on that service, or call your card issuer if you entered card details.

From here on, this is this site's advice. Unlike a password, your birth date cannot be changed later. Since it may have leaked, if you use the 4 or 6 digits of your birth date as a bank card or phone PIN, or as part of a password, change it.

With your name and email address also possibly known, "name + birthday" passwords become easy to try. When you replace a password, a password manager is the practical way to make it long and unrelated to you.

When a caller "confirms your identity" by reading out your name and date of birth, they can sound official. Name, birth date and phone number are all among the items here, which makes such calls easier to fake. If someone calls you, do not answer their questions on the spot; hang up and call back on the number listed on the company's official website.

The company's inquiry line is toll-free 0120-732-079 (10:00–17:00 Japan time, excluding weekends and holidays, callable from within Japan) and email incident-desk@dkkaraoke.co.jp (per its October 9 notice). It says email can be used if the phone line is busy. Confirm the number and address on the company's official website, not from an email or text you received.

When you outsource tabulation, mailing or analysis, exporting the whole member database puts columns and brands the task never uses onto the contractor's PCs. For each task, decide which columns are really needed before handing anything over.

For example: age bands instead of full birth dates for age-group reports, no email or phone number for work that involves no contact, member numbers instead of names. If the work is split by brand, split the files too. As a first step, pick one file you send to a contractor regularly and go through it column by column with the contractor, asking whether the task uses each one.

Once data is saved on a contractor employee's PC, that PC's malware protection and update status become your customers' protection, and you cannot see either. Where possible, have contractors work in an environment you manage (a virtual desktop that only streams the screen, or a shared workspace with downloads blocked) so that no files stay on their PCs.

For work that genuinely needs a local copy, require encryption, deletion when the task ends, and a deadline for confirming the deletion to you.

Japan's Act on the Protection of Personal Information requires a business that outsources the handling of personal data to exercise necessary and appropriate supervision over the contractor (Article 25). To make that supervision concrete, put the following in the contract or a memorandum:

• Requirements for devices that handle customer data: a tool that detects and records malware activity (such as EDR), OS and software updates, disk encryption, and no handling on personal devices
• Where customer data may be stored, and the deadline for deleting it after the work
• What happens when an infection or intrusion is found: a deadline for a first notice that does not wait for the scope investigation (for example, within 24 hours), set separately from the deadline for the investigation report

Check once a year that the contractor meets these requirements, through a written report on how it manages its devices or the results of its self-assessment.