More than 8.7 million karaoke fans are at risk after major data breach: Japanese giant Nippon Columbia says malware infection was to blame for records exposure
- Third-party contractor malware infection may have exposed data of 8.7 million customers and employees
- The exposed records included personal data, although no payment data or confirmed misuse was reported.
- Incident highlights supply chain risks, and Daiichi Kosho investigates and reviews contractor safety
Not even the entertainment industry is safe from data-stealing cybercriminals: Daiichi Kosho, one of the largest entertainment system manufacturers in Japan, has revealed a malware infection in its supply chain that may have resulted in the compromise of 8.7 million customer and employee information.
“Daiichi Kosho received a report from Nippon Columbia Group (NCG), to which the company outsources the handling of personal information, that a device used by an NCG employee was infected with malware and that the company’s customer information may have been leaked,” reads an automatically translated data breach notification letter.
“At this time, we have not confirmed that personal information was leaked externally or misused as a result of this incident. However, as we cannot rule out the possibility that personal information may have been leaked, we provide the information currently available, and the actions we will take, as follows. We have also confirmed that the company’s systems were not affected.”
Latest videos ofTechnologyRadar
Supply chain attack
The wording is intentionally ambiguous, as this is obviously a supply chain attack, as Daiichi Kosho was not directly compromised.
Instead, it was Nippon Columbia Group, a group formed in 2025 after a restructuring by Faith. Nippon’s roots date back to 1910, when its predecessor became Japan’s first record company. Today, Faith established Nippon Columbia Group as a new organization focused on AI-powered entertainment and content distribution.
Daiichi Kosho, on the other hand, is one of Japan’s leading karaoke and entertainment companies. It was founded in 1973 and today is best known for its DAM karaoke systems and Big Echo karaoke rooms. In fact, the company currently operates more than 400 karaoke rooms throughout Japan, including more than 100 in Tokyo alone.
The company sells and rents karaoke equipment, manages establishments and restaurants and produces music and videos. Daiichi Kosho is a major business that generates approximately 163 billion yen (about $1.06 billion) in annual revenue.
Malware infection
According beepcomputerDaiichi Kosho outsources the handling of its customers’ personal information to NCG. On October 5, 2026, that company notified Daiichi Kosho that it had found a malware infection and isolated the affected systems the next day. We don’t know exactly how the company ended up infected or what type of infection it was. What we do know is that it suspects that the records of 93,000 employees and 8,631,000 customers may have been exposed.
These records contain people’s full names, genders, dates of birth, email addresses, and phone numbers. Customers of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining are among those affected by the attack. No passwords, loyalty points or payment details were revealed, the notice said. Furthermore, there is no evidence that data has been misused on the dark web.
However, Daiichi Kosho warned employees and customers to be wary of incoming emails, especially unsolicited ones claiming to come from the company itself.
Personally identifiable information has value on the black market because threat actors can use it to launch highly personalized and personalized phishing attacks.
Through these attacks, they can steal login credentials for corporate environments or deploy data thieves to take over passwords. That allows them to tap into corporate IT infrastructure, steal trade secrets and other data, and establish persistence. Ultimately, all of this allows attackers to threaten to reveal the files to competitors and the public and thus pressure victims to pay a ransom.
Daiichi Kosho said it “will continue to monitor the situation and take necessary action if we detect any signs of unauthorized use.”
It also said that, out of an abundance of caution, it was now inspecting other systems and examining how it manages its contractors to see if there is room for improvement.
“If further investigation reveals any new facts, we will immediately provide an update, including which customers are affected and what actions to take,” the machine-translated notice reads.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment