Nippon Columbia: intruders used a network device flaw to reach its server and three group firms were hit, and 3,317 personal records of staff, families and others may have been viewed

1. 2025-07-17

   It confirmed that its server had suffered unauthorized access and restricted outside access. [1] [2]

2. 2025-08-08

   It announced the incident. Its group firms using the server, Columbia Marketing, Columbia Songs and Dream Music, were also hit. It reported to the Personal Information Protection Commission and others. [1] [3]

3. 2026-03-31

   It published the findings. It found no trace directly showing an outside leak but could not rule out viewing. [2]

Personal data that may have been viewed is 3,093 records of officers, employees, former employees and their families (name, address, phone number, email address, birth date and HR data such as basic pension number), 152 records of officers and employees of Face and Nippon Columbia Group, 16 records of contractor representatives and 56 records of staffing agency contacts, 3,317 in all. It believed an outside party used a network device flaw to reach the server. No secondary harm has been reported. [2]