Millions of customer and employee records were exposed from Daiichi Kosho, a popular Japanese entertainment company, in a data breach stemming from a malware infection at its contractor, the Nippon Columbia Group (NGC).
Daiichi Kosho operates more than 521 karaoke venues in Japan, including the Big Echo chain, the country’s most popular karaoke box. Nippon Columbia handles Daiichi Kosho’s customer and employee personal information.
Daiichi Kosho data breach impacts 8.7 million people
The data breach leaked the personal information of 93,000 Daiichi Kosho employees and 8,631,000 customers. It exposed their names, genders, dates of birth, email addresses, and telephone numbers. It affected numerous venues, including BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining customers. Daiichi Kosho operates more than 400 karaoke venues across Japan, including more than 100 in Tokyo alone, the country’s capital.
If confirmed, the exposure of email addresses and phone numbers puts victims at risk of targeted phishing attacks. Daiichi Kosho advises affected individuals to be on the lookout for unsolicited communication and to avoid clicking on suspicious links or downloading unfamiliar attachments. The company also advised customers that it does not request sensitive information, such as account passwords or credit card information, via email or text.
“If any information has been leaked, it may be misused for phishing scams, including spoofed emails. Please be vigilant for suspicious emails, text messages, and phone calls, and do not open links or attachments you do not recognize,” it stated.
Nevertheless, Daiichi Kosho has not confirmed whether the personal information was leaked or misused, but has advised affected individuals to exercise caution.
“However, as we cannot rule out the possibility that personal information was leaked, we are providing the information currently available and the actions we will take, as follows. We have also confirmed that the Company’s systems were not affected,” the company explained.
Luckily, the potentially leaked information does not include payment information or account passwords, and customer loyalty points have not been fraudulently redeemed.
So far, the karaoke system maker has not disclosed the identity of the threat actor and how they gained access to its contractor’s systems, and no threat actor has claimed responsibility for the data breach.
Daiichi Kosho data breach stemmed from a malware infection
Nippon Columbia told Daiichi Kosho that the data breach stemmed from a malware infection on one of its employees’ computers, which was immediately isolated upon detection.
“According to NCG, a device used by one of its employees (one PC) was found to be infected with malware between October 1 and October 2, 2026, and the device was isolated from the network on October 2. Following NCG’s investigation into the scope of the impact, the Company received a report from NCG on October 5.”
The entertainment system maker also changed passwords to terminate the threat actor’s access and launched an investigation involving external cybersecurity experts. It also promised to implement additional cybersecurity measures to prevent a similar data breach in the future. Vetting its third-party vendors also remains a priority for the company.
“We will review the investigation into the cause and the measures to prevent recurrence conducted by NCG and external specialists. We will also examine how we manage our contractors and implement any necessary improvements.”
