Personal data belonging to more than 8.6 million customers of Daiichi Kosho, Japan’s largest karaoke operator, may have been exposed after malware was found on a computer at Nippon Columbia Group, the contractor that handles the company’s customer data. The incident was reported by BleepingComputer on October 11.
What happened
Daiichi Kosho runs 521 karaoke venues across Japan, including the Big Echo chain, and outsources the handling of its customers’ personal information to Nippon Columbia Group (NCG), an entertainment company active in music, video and game production.
- October 5: NCG told Daiichi Kosho it had found malware on an employee’s computer.
- October 6: NCG isolated the affected system.
- October 9: Daiichi Kosho posted an update, which did not include further details about a possible data leak.
What data is involved
The records at risk cover 8,631,000 customers and 93,000 employees. They include full names, genders, dates of birth, email addresses and telephone numbers. According to the company, passwords were not exposed, and there is no evidence that customers’ loyalty points have been misused.
Customers of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining may be affected.
Much remains unconfirmed. Daiichi Kosho says it has not confirmed any theft or leak of data, and that its own systems were not breached. NCG has reset passwords and other login credentials and is investigating the cause and scope of the incident, including whether any data has appeared online. How the malware got onto the employee’s computer has not been disclosed. BleepingComputer said it could not find a public statement from NCG and was waiting for a response at the time of publication.
Why it matters
Even without passwords or payment details, a combination of names, birth dates, email addresses and phone numbers is valuable to scammers. It allows them to send convincing phishing messages that appear to come from a company the victim really uses. Daiichi Kosho is advising customers to be suspicious of unsolicited emails, text messages or phone calls asking for payments or for personal or financial information.
The incident is another example of risk sitting with a third party rather than with the brand customers know. A contractor’s failure was also at the center of the breach investigated in our report on the FBI’s latest ShinyHunters arrest, where the bureau said a contractor failed to apply a security patch.
Sources
- BleepingComputer: Nippon Columbia malware incident exposes 8.6 million karaoke fan records (October 11, 2026)
