Japanese entertainment and karaoke operator Daiichi Kosho has revealed that a cybersecurity incident involving a third-party service provider may have exposed the personal records of more than 8.7 million individuals, comprising both customers and staff members.
Malware Infection at Third-Party Contractor
According to a breach disclosure published by Daiichi Kosho, the incident originated within the systems of Nippon Columbia Group (NCG), an external partner tasked with managing customer data. An NCG employee device became infected with malware, prompting concerns that sensitive information maintained by the contractor had been compromised.
In a machine-translated statement, Daiichi Kosho detailed the contractor alert: “Daiichi Kosho has received a report from Nippon Columbia Group (NCG), to which the Company outsources the handling of personal information, that a device used by an NCG employee was infected with malware and that the company’s customer information may have been leaked.”
The company emphasized that its own corporate systems were not directly breached during the event. “At this time, we have not confirmed that personal information was actually leaked externally or that it was misused as a result of this incident,” the disclosure continued. “However, as we cannot rule out the possibility that personal information was leaked, we are providing the information currently available and the actions we will take, as follows. We have also confirmed that the company’s systems were not affected.”
Scope of the Incident and Affected Brands
Preliminary assessments indicate that up to 8,631,000 customer records and approximately 93,000 employee files may have been exposed as a consequence of the device compromise. The affected datasets contain sensitive personally identifiable information, including full names, dates of birth, genders, telephone numbers, and email addresses.
Daiichi Kosho clarified that more critical elements such as passwords, loyalty point balances, and financial payment records were not compromised in the incident. Furthermore, investigations have uncovered no indication that the exposed data has surfaced or been misused across illicit forums on the dark web.
The affected customer base includes patrons of several popular hospitality and entertainment brands operated under the Daiichi Kosho umbrella. Among the impacted businesses are BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and the dining chain DK Dining.
Incident Timeline and Response Measures
Reports indicate that NCG notified Daiichi Kosho of the malware infection on October 5, 2026, and moved to isolate the impacted infrastructure on the following day. Public details regarding the specific strain of malware, how the endpoint was initially infected, or the technical mechanics of the intrusion have not been disclosed by either firm.
Following notification of the breach, Daiichi Kosho announced proactive steps to evaluate its overall security posture and manage third-party vendor relationships. The company noted that, out of an abundance of caution, it is currently inspecting additional internal environments while reviewing its oversight procedures for external contractors to identify areas for security enhancement.
The firm committed to keeping stakeholders informed as the probe continues, stating: “If further investigation reveals any new facts, we will promptly provide an update, including the customers affected and the measures to be taken.” Daiichi Kosho added that it will maintain ongoing monitoring and enact appropriate countermeasures should unauthorized use of the data be observed.
Corporate Profiles and Heightened Phishing Risks
Daiichi Kosho is among Japan’s leading karaoke and entertainment conglomerates, established in 1973 and generating roughly ¥163 billion (around $1.06 billion) in annual revenue. The organization operates more than 400 karaoke venues throughout Japan—with over 100 locations situated in Tokyo—alongside managing restaurant chains, manufacturing and renting DAM karaoke hardware, and producing commercial music and video content.
Contractor Nippon Columbia Group was formed in 2025 following a restructuring of Faith. The group traces its origins to 1910 as Japan’s initial commercial record label, with the restructured entity focusing on artificial intelligence-driven entertainment and media distribution.
Despite the absence of evidence showing active exploitation, Daiichi Kosho has advised both employees and clientele to exercise caution regarding communications received via email. The company specifically highlighted the risk of unsolicited messages attempting to impersonate the brand, warning recipients against clicking suspicious links or submitting credentials, given that exposed personal details can be weaponized in targeted phishing and credential-harvesting campaigns.
