Daiichi Kosho Discloses Supply Chain Breach Exposing Eight Million Customer Records
A malware infection at a data processor has potentially leaked personal details of over eight million karaoke customers, prompting security warnings.
Key points
- Daiichi Kosho reports that a supplier, Nippon Columbia Group, discovered malware on an employee device in early October 2026.
- Personal data including names, genders, dates of birth, emails, and phone numbers may have been exposed for approximately 8.724 million customers.
- The company urges users to watch for phishing attempts and has opened a toll-free line for inquiries regarding the incident.
Daiichi Kosho announced on October 8, 2026, that a supply chain partner’s malware infection may have exposed the personal information of more than eight million customers. The Japanese entertainment operator stated that it received a report from Nippon Columbia Group (NCG) on October 5 following an investigation into the scope of the security incident.
According to Infosecurity Magazine, NCG handles customer information for Daiichi Kosho. The supplier detected a malware infection on one of their employees' devices, specifically a PC, between October 1 and October 2, 2026. The device was isolated from the network on October 2. Daiichi Kosho noted that work-related personal data was temporarily stored on that specific device, making a data leak possible.
Incident Details and Timeline
NCG reset affected passwords and continued investigating whether the data was actually compromised or merely at risk. Daiichi Kosho could not rule out the possibility that the information had been leaked to external parties based on their current knowledge. The timeline shows a rapid response from the supplier, with isolation occurring the day after detection and a formal report to the client four days later.
The company emphasized that the data in question was related to work outsourced to NCG. This includes sensitive personal identifiers that could be used for identity theft or social engineering attacks if successfully exfiltrated. No confirmation of actual data exfiltration has been provided, only the possibility based on the malware presence on the storage device.
Affected Brands and Customers
Daiichi Kosho estimated that approximately 8,724,000 customers who registered or made reservations at its stores might have had their data leaked. The affected information includes registered names, genders, dates of birth, email addresses, and telephone numbers. This figure represents a significant portion of the operator’s customer base across multiple popular entertainment brands.
The majority of those impacted are customers of Big Echo, which accounts for 5.6 million of the potentially affected individuals. Another major segment involves DK Dining brands, with 3.5 million customers potentially exposed. Other affected businesses under the Daiichi Kosho umbrella include Mega Big, Banana Club, Karaoke Club Dam, and B-Garage.
What should you do?
Daiichi Kosho has opened a toll-free number for concerned customers to contact the company while the investigation continues. The firm urged users to remain vigilant against suspicious emails, SMS messages, and phone calls that might attempt to exploit the leaked information. They specifically advised against opening unrecognized links or attachments.
The company reiterated that it will never ask customers for their passwords or credit card information through unsolicited communications. Users are encouraged to exercise continued caution when interacting with digital services. This incident follows several cyber-attacks in Japan in recent weeks, including separate incidents involving two major railway operators in the Tokyo region in September.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Daiichi Kosho
- Monitor your email and phone for unexpected contact from karaoke services, especially requests for passwords or payment details.
- Enable multi-factor authentication on your email and entertainment accounts to add a layer of security against credential misuse.
- Review your credit card and bank statements regularly for any unauthorized charges or suspicious activity.
- Report any phishing attempts or suspicious messages to your email provider or local cybersecurity authority immediately.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many customers were affected by the Daiichi Kosho data breach?
Approximately 8,724,000 customers who registered or made reservations may have had their personal data exposed.
What type of personal information was potentially leaked?
The exposed data includes names, genders, dates of birth, email addresses, and telephone numbers.
Which karaoke brands are involved in this incident?
Affected brands include Big Echo, DK Dining, Mega Big, Banana Club, Karaoke Club Dam, and B-Garage.
