ONE of Japan’s largest karaoke groups, Daiichi Kosho, disclosed a potential data breach stemming from a supplier incident that may have exposed personal information for up to about 8.7 million customers. The breach source is an incident at Nippon Columbia Group (NCG), a Japanese entertainment company handling customer data for Daiichi Kosho. NCG reported that between 1 and 2 October 2026 a malware infection affected an employee PC, which was isolated from the network on 2 October.
Following an assessment, NCG informed Daiichi Kosho on 5 October that personal data used for work outsourced to Daiichi Kosho could have been stored on the infected device, and thus may have been leaked. NCG has since reset affected passwords and is investigating the scope of the impact and whether data was compromised.
Daiichi Kosho warned that approximately 8,724,000 customers who registered or made reservations at its stores may have had their names, genders, dates of birth, email addresses and telephone numbers exposed to external parties. The majority of those affected are customers of Big Echo (about 5.6 million) and the DK Dining brands (about 3.5 million), with other brands including Mega Big, Banana Club, Karaoke Club Dam and B-Garage also mentioned.
The company urged customers to be vigilant for phishing attempts using the exposed information and set up a toll-free line for concerns while it investigates the incident. The broader context noted ongoing cyber activity in Japan and a new Active Cyber Defence law that may affect responses, but it is unclear how these developments will influence individual organisations.