Daiichi Kosho Says Contractor Malware Put 8.7 Million Customer and Employee Records at Risk

Malware on a contractor’s computer may have put more than 8.7 million customer and employee records associated with Daiichi Kosho at risk, the company said. Daiichi Kosho said it had not confirmed data theft or leakage, and that its own systems were not breached.

Key Points

• The potentially affected records include about 8.63 million customer records and 93,000 employee records.
• The information was handled by contractor Nippon Columbia Group (NCG), not stored on Daiichi Kosho’s own systems.
• Data theft and misuse have not been confirmed, and passwords were not among the potentially exposed information.
• Daiichi Kosho and NCG are investigating the incident and reviewing security measures.

What may have been exposed

Daiichi Kosho outsources the handling of customer personal information to Nippon Columbia Group (NCG), a Japanese entertainment company involved in music, video and game software production and distribution, as well as artist management. The information was temporarily stored on an NCG employee’s computer as part of work for Daiichi Kosho.

The potentially affected records comprise approximately 8,631,000 customer records and 93,000 employee records, for a total of about 8,724,000. The customer records relate to people who registered as members or made bookings, and duplicate records were removed from the count. Approximately 74,000 records were associated with Karaoke CLUB DAM, and about 515,000 duplicate records were removed. The data fields may include names, gender, dates of birth, email addresses and phone numbers.

The businesses potentially affected include BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining. Daiichi Kosho operates 521 karaoke venues nationwide, including the Big Echo chain, and is described as Japan’s largest karaoke operator.

The available incident accounts give differing dates for discovery and containment. One account says NCG found malware on an employee’s computer between October 1 and October 2 and isolated it on October 2; another says the malware was discovered on October 5 and the computer was isolated the following day. NCG notified Daiichi Kosho on October 5, according to the company’s account.

Accounts also give different dates for the public disclosure: one dates Daiichi Kosho’s disclosure to October 8, while another says the incident was publicly reported on October 11, 2026. The malware strain, initial infection method and activity performed by the malware had not been established in the initial reporting.

Investigation and customer advice

Daiichi Kosho said it had not confirmed that data was stolen or leaked. The company said passwords were not included and that the exposed information alone could not be used to spend loyalty points; it had seen no evidence of unauthorized point use.

NCG reset passwords and other authentication credentials and is investigating the cause and scope of the incident, including whether information was taken or published online. Outside specialists are involved in the investigation. Daiichi Kosho said it would review NCG’s findings and prevention measures with outside investigators, assess its contractor-management practices and strengthen them as needed, and inspect its own systems as a precaution.

Daiichi Kosho advised customers to remain vigilant against unsolicited emails, text messages and phone calls requesting payments or sensitive personal and financial information. The company warned customers not to disclose confidential details, including passwords, credit card information or other banking credentials, in response to suspicious communications.

It also urged customers to verify the authenticity of any communication claiming to represent the company before taking action or sharing personal information. As part of its response to the incident, Daiichi Kosho established a free-dial enquiry line on October 9 to address customer concerns and provide assistance. Customers who suspect they have received fraudulent messages or have disclosed sensitive information were encouraged to exercise caution and seek clarification through the designated support channel.