Daiichi Kosho karaoke breach exposes personal data of 8.7 million people via contractor

On 9 October 2026, Daiichi Kosho — Japan's largest karaoke operator, which runs the BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining brands across hundreds of venues — warned that the personal data of roughly 8.72 million people may have been exposed through a malware infection at an external contractor. The company said its own systems were not breached; the compromise occurred at Nippon Columbia Group (NCG), the entertainment company it outsources customer-data handling to.

According to the disclosures, NCG told Daiichi Kosho on 5 October that malware had been discovered on an employee's computer, and isolated the affected system the following day while resetting authentication credentials. The data potentially exposed covers about 8,631,000 customers and roughly 93,000 others, and includes full names, gender, dates of birth, email addresses and telephone numbers. The companies said passwords were not included, and Daiichi Kosho reported no evidence that loyalty points or other account features had been misused.

Status

As of the disclosure, Daiichi Kosho said it had not confirmed any theft or leak of the data, and NCG was still investigating the cause, the full scope, and whether any information had appeared online. Because the investigation is ongoing and a leak cannot be ruled out, the figures above describe the records potentially at risk rather than a confirmed exfiltration.

The companies urged customers to be cautious of unsolicited emails, text messages or phone calls that reference Daiichi Kosho or request payments or sensitive information, warning that the exposed contact details could be used to make phishing and fraud attempts look convincing.

Context

The incident was one of several large data breaches disclosed by Japanese firms in the same week, with second-hand retailer Bookoff Group separately reporting a potential leak affecting up to about 6.43 million customers. The pattern underlines a recurring systemic risk: a company can keep its own network secure yet still see millions of records exposed when a trusted contractor that processes its data is compromised. For a consumer brand the size of Daiichi Kosho, the combination of verified names, birth dates and contact details is precisely the bundle that scammers use to make fraudulent approaches appear legitimate.