A malware infection on a single employee PC at Nippon Columbia Group (NCG) may have exposed personal data on millions of customers and employees of Daiichi Kosho. Daiichi Kosho is Japan's largest karaoke company and runs the Big Echo chain and the DAM karaoke system. Daiichi Kosho disclosed the incident in a notice dated October 8, 2026, which puts the total at about 8,724,000 records. BleepingComputer, Kyoto Shimbun, Sankei and Nikkei covered it afterwards. The figures vary by source. BleepingComputer's headline gives 8.6 million customer records and its body says "more than 8.7 million". BleepingComputer and BeyondMachines split the total into about 8.631 million customer records and 93,000 employee records, while AliasFleet rounds the employee figure to "roughly 90,000". Daiichi Kosho says it has not confirmed that any data left the network or has been misused. It also says its own systems were not affected.
What Happened
Daiichi Kosho contracts NCG to handle part of its customers' personal data. NCG is a Japanese entertainment group covering music, video, game software and artist management. According to Daiichi Kosho's notice, one PC used by an NCG employee was infected with malware between October 1 and 2, 2026. Daiichi Kosho data from the work it had outsourced to NCG was stored on that PC temporarily.
The timeline differs between sources:
- Daiichi Kosho's notice (also reflected by BeyondMachines and AliasFleet): the infection happened October 1 to 2, NCG took the device off the network on October 2, and NCG reported to Daiichi Kosho on October 5 after looking into the scope.
- BleepingComputer: NCG told Daiichi Kosho on October 5 that it had found the malware, and isolated the system "the following day". That would mean October 6.
This brief follows the company's own account (isolation on October 2) and flags the gap. Either way, the data owner did not hear about it until several days after the infection.
NCG says it has reset passwords and other authentication credentials. It is investigating how the infection happened, how far it reached, and whether data has been leaked, including whether anything has been posted online. Daiichi Kosho has set up a dedicated phone and email support service (BeyondMachines). It says it is working with the relevant organizations and will take further action if it sees signs of misuse.
According to BleepingComputer, Daiichi Kosho runs 521 karaoke venues in Japan. The notice names these affected brands: BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining.
What Was Taken
Nobody has confirmed that data was stolen. The company says the data "may have been leaked". The records at risk belong to people who signed up as members or made reservations at Daiichi Kosho stores, plus employees. They contain:
- Full or registered names
- Gender
- Date of birth
- Email address
- Telephone number
Volume: Most sources give about 8.724 million records in total (Daiichi Kosho's notice, ITD, Hakky, AliasFleet, Tarosoku and BeyondMachines). Newsquawk rounds this to 8.7 million. BleepingComputer's headline uses the 8.6 million customer-only figure. BeyondMachines points out that the number of affected individuals has not been confirmed. A record count is not a headcount, because one person can be registered with more than one brand.
Per-brand split: The sources disagree here. Japanese outlet Tarosoku reports about 5.558 million Big Echo records, 43,000 MEGA BIG records, 74,000 Karaoke CLUB DAM records, and about 3.049 million listed as "other" (including Banana Club). AliasFleet instead describes about 8.63 million records as "Big Echo member registrations". Until Daiichi Kosho publishes a breakdown, treat both as unverified.
Not included: Passwords are not in the data, and Daiichi Kosho says it has found no unauthorized use of loyalty points. Tarosoku reports that payment card data was not affected. Daiichi Kosho has said it will never ask for passwords or card details in connection with this incident. ITD notes that the notice does not say whether former employees are included.
Why It Matters
This is a third-party data handling failure. The data owner's own systems were not breached, yet millions of records were sitting on one contractor's endpoint. Several points matter for defenders:
- One PC, millions of records. A dataset of this size on one employee's computer, even "temporarily", suggests bulk exports or working copies that sit outside the controls of the main system.
- Weak data for fraud on its own, strong for phishing. Name, date of birth, phone and email are enough to make convincing fake coupon, membership renewal or expiring-points messages that look like they come from Big Echo or DAM. ITD warns that a date of birth is a common PIN or password and a common answer to identity-check questions on phone calls.
- Notification delay. Under the company's own timeline, three days passed between isolating the device and telling the data owner.
- A recurring pattern in Japan. Hakky compares the incident to a contractor breach at Daiwa Securities (about 220,000 records reported) and Yakiniku King's reported 10.78 million member records. Newsquawk notes that contractors have repeatedly been the weak point in Japanese corporate incidents, and that the dispute over liability between a company and its subcontractor often becomes the next story.
The Attack Technique
Very little is known. No source names the malware family, how it got onto the PC (phishing, drive-by download or something else), any threat actor, or whether the data was exfiltrated. AliasFleet also notes it is unknown how long the PC was compromised before detection, and how much of the dataset the attacker could actually reach.
What is known:
- One NCG employee PC was infected with malware.
- Daiichi Kosho customer and employee data was stored on that PC temporarily.
- The device was isolated (October 2 per Daiichi Kosho, possibly October 6 per BleepingComputer).
- Credentials were reset afterwards. That suggests NCG considered credential theft a possibility, which is consistent with, but does not prove, infostealer-type malware.
No group has claimed responsibility, and no leak-site listing has been reported.
What Organizations Should Do
- Ban bulk personal data on vendor endpoints. Contracts should require that outsourced processing happens inside controlled environments (VDI, managed data rooms), not as exports to employee PCs. Audit the vendor for compliance.
- Set deadlines for vendor breach reports. Contracts should require notice within hours of detecting a suspected compromise, not after the vendor finishes scoping. You need the clock to start when they detect it.
- Give vendors only the data they need. Send contractors only the fields and records a task needs. Delete or expire working copies when the task ends, and get proof that they were deleted.
- Require EDR and egress monitoring at vendors that hold your data. Ask for endpoint detection, DLP and outbound traffic logs so exfiltration can be confirmed or ruled out quickly. Without these logs, a company can only say "may have leaked".
- Prepare for the phishing that follows. Warn customers proactively, monitor for lookalike domains and fake messages using your brand, and tell customers through official channels what you will never ask them for.
- Stop using date of birth as an authentication factor. Treat leaked DOB and phone data as compromised for identity checks at help desks and in account recovery.
Sources: Nippon Columbia malware incident exposes 8.6 million karaoke fan re... | Notice Regarding the Potential Leakage of Personal Information at a... | Daiichikosho Data Leak Risk (8.72 Million Records, 2026): What Big... | Daiichikosho: 8.72 Million Member Records Potentially Leaked Hakky... | Daiichi Kosho Says 8.72 Million Customer Records May Have Leaked -... | Daiichikosho (7458 JT) notes that data related to 8.7mln customers... | 第一興商で872万件情報漏えいの恐れ！対象サービスや原因まとめ｜たろ速 | Daiichikosho Customer and Employee Data Potentially Exposed in Thir...