Daiichi Kosho discloses 8.7 million exposed records after malware hit its data contractor
Daiichi Kosho, Japan's largest karaoke maker, says malware at Nippon Columbia, one of its contractors, left more than 8.7 million records on its customers and employees exposed. The data sat with the contractor, so one infected workstation there put 8.6 million karaoke customers in scope.
The Watch · Security desk
Bar comparison of exposed records: 8,631,000 customer records against 93,000 employee records, according to Daiichi Kosho. Customers make up almost all of the exposure. The records include full names, genders, dates of birth, email addresses and telephone numbers.
Records in the exposed data, per Daiichi Kosho's disclosure In records
| Item | Value | Claim |
|---|---|---|
| Customers | 8,631,000 records | 3 |
| Employees | 93,000 records | 3 |
What happened
- Nippon Columbia Group told Daiichi Kosho on October 5 that it had found malware on an employee's computer, and the affected system was isolated the following day.
- The exposed records cover 8,631,000 customers and 93,000 employees, with full names, genders, dates of birth, email addresses and phone numbers.
- Customers of six brands may be affected: Big Echo, Mega Big, Karaoke Club DAM, Banana Club, B-Garage and DK Dining.
- Daiichi Kosho has not confirmed that any data was stolen or leaked, but it is telling customers to stay cautious.
- NCG has reset passwords and other credentials and is investigating the cause, the scope and whether any data has been posted online.
Why it matters
- Who's exposed exposure If the records left NCG's network, 8.6 million karaoke customers can be targeted by scam calls and texts that quote their real birth date and phone number.
- What it limits constraint NCG's credential reset closes the access path on its own side. It does nothing for customers, who cannot change a birth date or a name the way they change a password.
- Who has to decide decision Operators that hand customer data to a contractor now have to decide how much of the file the contractor's staff computers can reach. Here, by Daiichi Kosho's account, one infected machine led to a disclosure covering 8,724,000 records.
Next story · Security · 9h ago
Burger King Japan app breach reached 11.18 million customer records over six daysConfirmed2 publishers
Daiichi Kosho says its own systems were not breached [4]. In our view that changes little for the people in the file. The company outsources the handling of its customers' personal information to Nippon Columbia Group [9]. NCG is an entertainment group. Its businesses are music, video and game software and artist management [9]. The two counts Daiichi Kosho gave add up to 8,724,000 records [14].
The infected system was isolated on October 6 [16]. On the evidence so far this is one infected computer at one contractor [15]. We'd treat it as a single incident until data turns up online or a group claims it. The reporting does not identify the malware, how it reached the employee's machine, who deployed it, or any link to a wider campaign [10].
If the data left NCG's network, an attacker has a customer list with birth dates attached. In our view it does not open accounts on its own. The exposed data does not include passwords, and Daiichi Kosho has seen no evidence of unauthorized use of loyalty points [12]. What the list does allow is a scam call or text that quotes a customer's real name, birth date and phone number to sound official. Daiichi Kosho's advice to customers is to distrust unsolicited email, SMS or phone calls that ask for payment or for personal or financial information [13].
Daiichi Kosho operates 521 karaoke venues across Japan [7] and made the disclosure under its own name [1]. Its Friday update added nothing on whether any data leaked [6]. BleepingComputer could not find a public announcement from NCG about the incident and has asked the firm for a statement [8].
What to watch
- Whether NCG's investigation finds that data was actually taken, or the records appear on a leak site.
- A public statement from Nippon Columbia Group on how the malware reached the employee computer and what that machine could access.
- Reports of scam calls or texts aimed at Big Echo or Karaoke Club DAM customers that quote birth dates or phone numbers.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence62
Perspective Coverage
4 publishers- Builder
- Builder 21%
- Operator
- Operator 55%
- Investor
- Investor 24%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Daiichi Kosho disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records.
- [2]
Daiichi Kosho says it has not confirmed any data theft or leaks but is advising customers to remain cautious due to the potential risk.
- [3]
The exposed data contains records for 93,000 employees and 8,631,000 customers, including full names, genders, dates of birth, email addresses and telephone numbers.
- [4]
Daiichi Kosho said its own systems were not breached.
- [5]
NCG reset passwords and other authentication credentials and is investigating the cause and scope of the incident, as well as whether any data has been leaked online.
- [6]
An update on Friday did not provide additional information about the possibility of a data leak.
- [7]
Daiichi Kosho is the largest karaoke maker in Japan and operates 521 karaoke venues nationwide, including the Big Echo chain.
- [8]
BleepingComputer could not find a public announcement from NCG about the security incident and contacted the firm for more details.
- [9]
Daiichi Kosho outsources the handling of its customers' personal information to Nippon Columbia Group (NCG), a Japanese entertainment group whose businesses include music, video and game software production and distribution, and artist management.
- [10]
The BleepingComputer report does not identify the malware, how it reached the employee's computer, who deployed it, or any link to a wider campaign.
- [11]
The incident may impact customers of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining.
- [12]
The exposed data does not include passwords, and there is no evidence of unauthorized use of loyalty points.
- [13]
The recommendation is to be suspicious of unsolicited communication via email, SMS or phone calls requesting payments or sensitive personal or financial information.
- [14]
The customer and employee counts add up to 8,724,000 records, consistent with the reported 'more than 8.7 million'.
- [15]
NCG informed Daiichi Kosho on October 5 that it had discovered malware on an employee's computer, and the affected system was isolated the following day.
- [16]
The affected system was isolated on October 6.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comNippon Columbia malware incident exposes 8.6 million karaoke fan records
1 article · October 11, 2026
- dev.toNippon Columbia Contractor Breach: 8.7M Records via Supply Chain Malware
1 article · October 11, 2026
- infosecurity-magazine.comKaraoke Giant Reveals Data Breach Impacting Eight Million
1 article · October 12, 2026
- scworld.comJapanese karaoke maker Daiichi Kosho reports data breach affecting 8.7 million records
1 article · October 12, 2026
Topics and entities
Topics
- Japan Cybersecurity
- Fourth-Party Infrastructure Risk
- Data Breaches
Entities
- Nippon Columbia Group