Daiichi Kosho runs the Big Echo chain and makes the DAM karaoke system. On October 8, 2026, it disclosed that malware on a single employee PC at its data-processing contractor, Nippon Columbia Group (NCG), may have exposed personal data for about 8,724,000 people. Reporting on the breakdown is not consistent. BleepingComputer, Threadlinqs and gblock.app split the total into about 8,631,000 customers and 93,000 employees. Infosecurity Magazine quotes the company's notice as saying "approximately 8,724,000 customers." Headlines range from "eight million" (Infosecurity Magazine) through 8.6M (BleepingComputer, Lawing Tech, gblock.app) to 8.7M (TechRadar, SC Media, Cybernews), depending on whether employee records are counted. Daiichi Kosho says it has not confirmed that any data was actually stolen or misused, but it cannot rule out a leak. It also says its own systems were not affected.
What Happened
The source sentence lists three outlets, so three is correct as written. The publication's framing calls Nippon Columbia the karaoke company, but every source places the karaoke business with Daiichi Kosho. Nippon Columbia is the contractor that held the data. TechRadar describes NCG as a group formed in 2025 out of a restructuring of Faith, with roots going back to Japan's first record company in 1910. Daiichi Kosho outsources the handling of customer personal information to NCG.
Accounts of the timeline differ:
- Daiichi Kosho's own notice, quoted by Infosecurity Magazine, Cybernews, gblock.app and Threadlinqs, says NCG found the malware infection between October 1 and 2. NCG cut the device off from the network on October 2, looked into the scope of the impact, and reported to Daiichi Kosho on October 5. Daiichi Kosho went public on October 8.
- BleepingComputer, followed by SC Media and Lawing Tech, says the malware was discovered on October 5 and the system was isolated on October 6.
This brief uses the company's own timeline, which is quoted directly in several reports. The October 5/6 dates appear to confuse the date NCG notified Daiichi Kosho with the date the infection was discovered. Threadlinqs flags the same discrepancy.
According to the notice, personal data from the outsourced work was "temporarily stored" on the infected PC. NCG has reset passwords and other credentials. It is investigating the cause, the scope, and whether any data has appeared online. SC Media reports that Nippon Columbia itself had made no public statement at the time of its report.
What Was Taken
Nothing has been confirmed as taken. The data that may have been exposed includes:
- Registered or full names
- Gender
- Date of birth
- Email address
- Telephone number
Daiichi Kosho says passwords were not included and it has seen no unauthorized use of loyalty points. TechRadar and Lawing Tech add that no payment card data was involved.
Affected brands include BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining. BleepingComputer says Daiichi Kosho runs 521 karaoke venues nationwide. For per-brand numbers, gblock.app, which says it worked from the Japanese-language notice, puts Big Echo at about 5,558,000 records and DK Dining at about 3,462,000, before about 515,000 duplicates are removed. Cybernews rounds these to 5.6M and 3.5M. These breakdowns have not been checked against the primary notice for this brief.
Cybernews reports that Daiichi Kosho has opened a toll-free helpline for affected customers.
Why It Matters
This is a third-party data-custody failure. Daiichi Kosho's systems were not compromised, but a contractor endpoint held a working copy of nearly nine million customer records. That copy was effectively outside Daiichi Kosho's security controls, and one infected workstation was enough to put all of it at risk.
The exposed fields contain no credentials, but name, date of birth, email and phone number together are a strong base for targeted phishing and smishing. Attackers could pose as Big Echo or DK Dining and send messages about bookings, loyalty points or account checks, and recipients would have little reason to doubt them. Daiichi Kosho has warned about exactly this. It says it will never ask customers for a password or credit card number.
Even if the investigation finds that nothing was exfiltrated, the exposure points to a common governance gap: outsourced processors keeping bulk personal data on ordinary employee endpoints.
The Attack Technique
No public information names the malware family, the initial infection vector or a threat actor. No group has claimed the incident, and none of the sources report data appearing on leak sites.
What is known:
- One NCG employee PC was infected.
- Bulk customer data was "temporarily stored" on that device.
- NCG's response included resetting credentials, which suggests it is treating credential theft as possible. This fits an infostealer-style infection, though no source confirms that.
Threadlinqs, a threat-intel aggregator, rates the incident medium severity with low attribution confidence. It maps the incident to MITRE ATT&CK T1199 (Trusted Relationship), T1078 (Valid Accounts) and T1005 (Data from Local System). That is its own analytic assessment and has not been disclosed by either company.
What Organizations Should Do
- Ban bulk personal data on contractor endpoints. Contracts should require processors to handle data in controlled server-side environments, not keep local copies on workstations. Audit for compliance.
- Minimise and time-limit shared data. Give processors only the fields and records each task needs, and enforce deletion once the task is done. A "temporary" local copy is still a live liability.
- Require endpoint protection and notification SLAs from suppliers. EDR coverage, infostealer detection and a contractual deadline for breach notification should be standard. Here, about three days passed between NCG isolating the device and notifying Daiichi Kosho.
- Rotate credentials across the trust boundary. When a contractor endpoint is compromised, reset any API keys, service accounts or shared credentials the contractor uses to reach your environment, not only theirs.
- Prepare customers for phishing ahead of time. Publish clear "we will never ask for X" guidance, and watch for lookalike domains and SMS sender spoofing of your brands after any exposure.
- Monitor for the data turning up. Watch infostealer log markets and leak forums for your customer datasets and contractor credentials, so you can confirm or rule out exfiltration quickly.
Sources: Over 8.7 million karaoke fans at risk after major data breach — Jap... | Nippon Columbia malware incident exposes 8.6 million karaoke fan re... | Karaoke Giant Reveals Data Breach Impacting Eight Million | Japanese karaoke maker Daiichi Kosho reports data ... | Daiichi Kosho data breach exposes 8.7M customers | Daiichi Kosho Breach May Expose 8.6M Big Echo Karaoke Customers | Nippon Columbia Group contractor malware Threadlinqs | Malware incident at Nippon Columbia: 8.6 million customer records e...