Japanese karaoke operator Daiichi Kosho has disclosed a potential data breach affecting approximately 8.72 mn customer and employee records after malware was discovered on a computer belonging to its outsourcing partner, Nippon Columbia Group (NCG).
In an October 8, 2026, announcement, the company said the security incident could have exposed personal information associated with its karaoke and restaurant businesses, including Big Echo, one of Japan’s largest karaoke chains.
- Japanese karaoke operator Daiichi Kosho has warned that approximately 8.72 mn customer and employee records may have been exposed following a malware infection at contractor Nippon Columbia Group.
- The potentially affected information includes names, genders, dates of birth, email addresses and telephone numbers. Big Echo accounts for 5.56 mn records, while DK Dining accounts for 3.46 mn, before accounting for duplicates.
- No confirmed data theft or misuse has been identified. The contractor has reset affected credentials, while cybersecurity specialists investigate the incident and potential exposure.
NCG discovered malware on an employee’s computer between October 1 and October 2 and disconnected the affected device from its network on October 2. Following an initial investigation, the contractor notified Daiichi Kosho on October 5.
The computer had temporarily stored personal information processed on behalf of the karaoke operator. Although unauthorized disclosure remains possible, Daiichi Kosho said investigators had not established that information had been transferred outside the contractor’s systems. The company also reported no evidence that its own systems had been compromised.
Big Echo and DK Dining account for most potentially exposed records
According to Daiichi Kosho, the incident may affect approximately 8.63 mn customer records and 93,000 employee records, bringing the total to 8,724,000.
The potentially compromised information includes registered names, genders, dates of birth, email addresses and telephone numbers.
Big Echo-related records account for approximately 5.56 mn of the potential exposure, while DK Dining represents another 3.46 mn. The company’s figures also include approximately 515,000 duplicate records across its businesses.
Other affected brands include Mega Big, Karaoke CLUB DAM, Banana Club and B-Garage.
Daiichi Kosho confirmed that passwords were not included in the potentially exposed information. It also said the data alone would not allow unauthorized parties to redeem customer loyalty points, and no fraudulent point transactions had been detected.
The company warned that personal information, if obtained by attackers, could be used for impersonation and targeted phishing campaigns.
Customers have been advised to exercise caution when receiving unexpected emails, text messages or telephone calls, particularly those requesting sensitive information or containing unfamiliar links.
Daiichi Kosho emphasized that it does not request passwords or payment card information through such communications.
Third-party malware incident raises data security concerns
NCG has reset relevant authentication credentials and is working with external specialists to establish how the malware infection occurred and whether any information was extracted.
Daiichi Kosho is conducting additional checks of its own systems and reviewing security controls governing outsourced data processing.
The incident demonstrates the potential exposure created when suppliers temporarily store large volumes of customer information on individual devices. A compromise affecting a single contractor computer can place millions of records at risk even when the primary company’s systems remain unaffected.
The disclosure follows several recent cyber incidents involving Japanese businesses, including an attack affecting cloud services provider IDC Frontier and separate incidents involving railway operators and car rental companies.
Daiichi Kosho said it would continue monitoring for suspicious activity and strengthen oversight of its outsourcing partners where necessary.
The company has established a dedicated customer inquiry service and committed to publishing further information if investigators confirm data exposure or identify additional affected individuals.
As of its latest disclosure, the company had not confirmed external data leakage, unauthorized use of customer information or compromise of its internal systems.
