Malware at a contractor may have exposed records on about 8.6 million karaoke customers in Japan

Daiichi Kosho, the Japanese company behind the Big Echo karaoke chain, has not confirmed that anything was stolen or misused, but says the possibility of a leak cannot be ruled out. The potentially exposed data sat on a machine belonging to Nippon Columbia Group, which handles customer personal information on Daiichi Kosho’s behalf.

Daiichi Kosho states that it has confirmed no impact on its own systems, so the exposure sits entirely with the outsourced work.

What Daiichi Kosho says was on the infected computer

Daiichi Kosho, the Japanese company behind the Big Echo karaoke chain, said in its October 8, 2026 notice that personal data on about 8,631,000 customers, plus roughly 93,000 employees, may have been exposed after malware infected a computer at one of its contractors, Nippon Columbia Group. In its October 8 notice on a possible personal information leak at a contractor, Daiichi Kosho explains that the infected PC temporarily held personal data connected to work the company had outsourced. The fields involved are registered name, gender, date of birth, email address and telephone number. Passwords are not in the data. The company adds that loyalty points cannot be used with this information alone and that it has confirmed no unauthorized use of points.

The notice breaks a total of about 8,724,000 records down by brand: roughly 5,558,000 for Big Echo, 3,462,000 for DK Dining, 74,000 for Karaoke CLUB DAM, 43,000 for Megabig, 5,000 for Banana Club and 4,000 for B-GARAGE. About 515,000 duplicate entries are deducted, leaving a customer subtotal of about 8,631,000, and the 93,000 employee records bring the grand total to the 8.7 million range.

That arithmetic explains why coverage quotes two different numbers. BleepingComputer’s October 11 report gives the customer figure as 8,631,000 and the employee figure as 93,000, so the 8.6 million in customers alone and the 8.7 million combined describe the same incident. The same report describes Daiichi Kosho as Japan’s largest karaoke maker, running 521 venues.

A timeline that sources tell differently

Accounts of the timing do not fully match. Daiichi Kosho’s notice says malware was found on one Nippon Columbia employee PC on October 1 or 2, that the terminal was isolated from the network on October 2, and that Nippon Columbia reported the incident to Daiichi Kosho on October 5. BleepingComputer instead describes Nippon Columbia telling Daiichi Kosho on October 5 that it had discovered malware on an employee’s computer, with the system isolated the next day. The company’s own notice is the more direct record, though the two agree that Daiichi Kosho learned of it on October 5 and went public three days later.

The company’s wording is careful. As rendered in translation from the Japanese, Daiichi Kosho wrote that it “cannot rule out the possibility that personal information was leaked,” while also stating that it had not confirmed actual external leakage or misuse. Nippon Columbia told it that the cause and scope remain under investigation and that account passwords have been reset. BleepingComputer reported that it found no public statement from Nippon Columbia and had asked the firm for comment.

A follow-up notice dated October 9 added a toll-free customer line and an email desk, and repeated that no unauthorized use had been confirmed. That page did not restate the data types or the number of people involved. It said only that the company would continue investigating the cause, work with relevant authorities and work to prevent recurrence.

What customers are told, and the vendor question

Daiichi Kosho warns customers of fraudulent emails, text messages and phone calls, advises against opening unknown links or attachments, and says it will never ask for passwords or credit card information. Because the exposed fields include birthdates, email addresses and phone numbers rather than passwords, the company’s advice is aimed at spoofed contact, not account lockouts.

On its own side, the company says it is inspecting the systems it uses as a precaution, will check Nippon Columbia’s cause investigation and prevention measures with external specialist organizations, and will review its own vendor management. It promises to announce promptly any new facts, including the scope of affected customers and its response measures.

Outside analysts have pointed to contractor access as the lesson. Security writer Satyam Rastogi, in a post on DEV Community, recommends sorting contractors by the level of data access they hold, requiring breach notification within 48 hours in contracts, and isolating contractor access from production databases. Those are the author’s recommendations, not findings from this case, and the post itself says much of its attack analysis is inference.

Several points remain open. The malware has not been named, and neither company has described how it reached the machine or what it did there. A blog summary of Japanese press coverage stresses that the figure is the population at risk, not a confirmed count of victims, and none of the pages read mentions a regulator being notified. Until Nippon Columbia’s investigation reports back, the notices leave open how many of those records, if any, left the machine.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview