Daiichi Kosho runs Japan's largest karaoke business, including the Big Echo chain. It has disclosed that malware on one employee PC at its data-processing contractor, Nippon Columbia Group (NCG), may have exposed personal records belonging to millions of its customers and employees. Reported figures vary. Daiichi Kosho's own notice, as quoted by Infosecurity Magazine, gives "approximately 8,724,000." BleepingComputer splits that into 8,631,000 customers and 93,000 employees, a breakdown that Threadlinqs and CyberPress repeat. As a result, headlines range from 8.6 million (BleepingComputer, SafeState) to 8.7 million (TechRadar, SC Media, CyberPress). Neither company has confirmed that data was actually stolen or misused.
One correction to how this story is often framed: almost every confirmed detail comes from Daiichi Kosho. SC Media and SafeState both report that Nippon Columbia has made no public statement of its own about the incident.
What Happened
Daiichi Kosho outsources the handling of customer personal information to NCG, an entertainment group whose businesses include music, video and game software, and artist management. Daiichi Kosho posted its first notice about the incident on October 8, 2026. SafeState reports that a short update followed on October 9.
The timeline is the main point where the sources disagree:
- Daiichi Kosho's notice, as quoted by Infosecurity Magazine: NCG found the malware on an employee PC "between October 1 and October 2, 2026," isolated the device from the network on October 2, and reported to Daiichi Kosho on October 5 after assessing the scope.
- BleepingComputer, and SC Media and SafeState, which cite it: NCG told Daiichi Kosho on October 5 and isolated the system "the following day," October 6. SC Media goes further and gives October 5 as the date the malware was discovered.
Threadlinqs notes this discrepancy explicitly and says Japanese press coverage (Impress Internet Watch) matches the October 1–2 discovery and October 2 isolation. This brief gives more weight to the version quoted directly from the victim's notice. On that reading, about three days passed between containment at the contractor and notice to the data owner, and up to six days before customers were told.
Daiichi Kosho says its own systems were not affected but are being checked as a precaution. NCG has reset passwords and other authentication credentials. It is still investigating the cause and scope, including whether any of the data has appeared online.
What Was Taken
Nothing is confirmed as exfiltrated. Daiichi Kosho's notice says personal data from the outsourced work "was temporarily stored on the device in question, and we cannot rule out the possibility that this data may have been leaked."
Volume: Up to roughly 8.72 million records. Sources disagree on the makeup. BleepingComputer, Threadlinqs and CyberPress report 8,631,000 customers plus 93,000 employees. Infosecurity Magazine's quotation of the notice describes the 8,724,000 figure as "customers who registered or made reservations at our stores." Until the companies clarify, treat 8.63M to 8.72M as the range for customers.
Data types: Full or registered names, gender, date of birth, email address, and phone number.
Not included: Passwords and payment card data. Daiichi Kosho reports no evidence that customer loyalty points have been used without authorisation.
Affected brands: BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining.
Each field is low-sensitivity by itself. Together, name, date of birth, email and phone make a ready-made kit for targeted phishing, smishing and vishing at very large scale, all in Japanese.
Why It Matters
This is a third-party risk incident, not a breach of Daiichi Kosho's perimeter. A single infected endpoint at a processor put more than eight million records belonging to another company's customers at risk. The detail that matters is where the data was: a bulk copy of customer personal data was sitting, at least temporarily, on an individual workstation instead of in a controlled system. Adyog's analysis puts it this way: "the unit of risk is the copy, not the company."
There are also gaps in what has been disclosed. SafeState and CyberPress both point out that no malware family, infection vector, attacker, or exfiltration method has been named. NCG has published nothing, so any other company that uses NCG has no indicators to search for in its own environment. The timeline confusion, and the conflicting reports over whether 8.72M counts only customers or customers plus employees, show what happens when an incident is explained to the public secondhand by the data owner and not by the party that was compromised.
The Attack Technique
Little is confirmed. Here is what is known:
- An unidentified piece of malware infected one NCG employee's PC.
- Customer data from the outsourced processing work was stored on that PC temporarily.
- NCG isolated the device and then reset passwords and authentication credentials. Resetting credentials suggests NCG was concerned about credential theft, which fits an infostealer-type infection, though that has not been confirmed.
The commercial intel feed Threadlinqs rates the incident medium severity with low attribution confidence. It maps the incident to MITRE ATT&CK techniques including T1199 (Trusted Relationship), T1078 (Valid Accounts) and T1005 (Data from Local System). These are an analyst's inferences, not facts the victims have disclosed. No threat actor has claimed the incident, and no leak-site listing has been reported.
What Organizations Should Do
- Map where processors keep copies of your data. Contracts should cover more than "who processes." They should say where copies live, on which devices, and for how long. Ban bulk personal data on individual workstations, or limit it with a short retention period.
- Set notification deadlines measured in hours. A gap of three days or more between a contractor containing an incident and telling the data owner is too long. Require notice within 24 to 72 hours of detection, with a minimum set of indicators and scope details included.
- Require processors to share technical indicators. If a vendor is breached, it should provide malware family, hashes and C2 infrastructure to every affected client. This allows the clients to search their own environments, even if nothing is published publicly.
- Monitor endpoints that handle large exports. Put EDR, DLP and alerts on bulk file staging on any machine that processes outsourced personal data. Treat infostealer detections on those machines as possible data exposure from the start, not as routine cleanup.
- Prepare customers for phishing quickly. If contact data is exposed, send customers your anti-phishing guidance straight away. Daiichi Kosho's notice is a reasonable template: it states plainly that the company will never ask for passwords or card details.
- Remove credentials shared with the vendor. Rotate any API keys, service accounts or SFTP credentials used with a compromised processor, whether or not the processor says your systems were untouched.
Sources: Over 8.7 million karaoke fans at risk after major data breach — Jap... | Nippon Columbia malware incident exposes 8.6 million karaoke fan re... | Karaoke Giant Reveals Data Breach Impacting Eight Million | Japanese karaoke maker Daiichi Kosho reports data ... | Daiichi Kosho: 8.7M karaoke records at risk via vendor PC | Nippon Columbia Group contractor malware Threadlinqs | Nippon Columbia Data Breach Exposes 8.6 Million Records | Nippon Columbia Malware Attack Puts 8.7 Million Customer Records at...