Karaoke Giant Daiichi Kosho Reports Data Breach Affecting 8.8 Million Customers
Japanese karaoke operator Daiichi Kosho disclosed a data breach at a supplier, potentially exposing the personal information of up to 8.8 million customers.
Karaoke giant Daiichi Kosho, known for its Big Echo chain and karaoke systems, has announced a significant data breach originating from a third-party supplier, Nippon Columbia Group (NCG). The incident, which occurred between October 1 and October 2, 2026, involved a malware infection on an employee's device at NCG, a company that handles customer information for Daiichi Kosho.
NCG detected the malware infection on October 1 and isolated the affected device the following day. Following an internal investigation, NCG reported the potential scope of the breach to Daiichi Kosho on October 5. The compromised device had temporarily stored personal data related to work outsourced by Daiichi Kosho, leading to the possibility of external data leakage.
The potential exposure affects approximately 8.724 million customers who registered or made reservations across various Daiichi Kosho brands. The exposed data may include names, genders, dates of birth, email addresses, and telephone numbers. The majority of affected customers are from the Big Echo chain (5.6 million) and DK Dining brands (3.5 million), with other impacted businesses including Mega Big, Banana Club, Karaoke Club Dam, and B-Garage.
Daiichi Kosho has issued a warning to its customers, urging them to be vigilant against potential phishing attempts that might leverage the leaked personal information. Customers are advised to exercise extreme caution with suspicious emails, SMS messages, and phone calls, and to avoid opening unknown links or attachments. The company emphasized that it will never request passwords or credit card information from customers.
NCG has taken steps to mitigate the incident by resetting affected passwords and is continuing its investigation into the root cause and the extent of any data compromise. Daiichi Kosho has also established a toll-free number for concerned customers to seek further information and assistance as the company works to confirm the full details of the breach.
This incident occurs amidst a backdrop of increasing cyber-attacks targeting Japan. Recent weeks have seen breaches affecting major railway operators, a car-rental company, and a food and beverage giant. These events highlight ongoing cybersecurity challenges within the country, exacerbated by reported skills shortages and governance issues.
The Japanese government recently enacted a new Active Cyber Defence law, effective October 1, aimed at empowering defense forces and police to proactively neutralize hostile foreign servers. However, its impact on improving the cybersecurity posture of regular organizations, particularly small and medium-sized businesses, remains to be seen.
The malware infection at Nippon Columbia, a contractor for Daiichi Kosho, potentially exposed up to 8.724 million customer and employee records. While data theft remains unconfirmed and Daiichi Kosho's systems were not directly compromised, the incident highlights the risks associated with outsourced data handling. The affected information may include names, dates of birth, and contact details, impacting customers of various Daiichi Kosho services like BIG ECHO and Karaoke CLUB DAM.