Japan’s major karaoke company Daiichi Kosho has disclosed a cybersecurity incident that may have exposed the personal information of approximately 8.72 million records. The company, known for operating popular karaoke brands such as Big Echo, said the incident involved a computer belonging to an external service provider. The announcement was made on October 8, 2026, after the company received a report about a malware infection.
According to the company, the affected computer belonged to Nippon Columbia Group (NCG), which handles certain personal data on its behalf. Malware was discovered on an employee’s computer between October 1 and October 2, 2026. The device was disconnected from the network on October 2 to limit the potential impact. Daiichi Kosho received a report about the incident on October 5.
The information that may have been exposed includes registered names, gender, dates of birth, email addresses and phone numbers. The company reported that approximately 8.63 million customer records and 93,000 employee records could be affected. The customer information relates to several businesses, including Big Echo, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining. However, the company has not confirmed that the information was actually leaked.
The company also clarified that its own systems have not shown any confirmed impact from the incident. Passwords were not included in the information identified as potentially exposed, and the company stated that these details alone cannot be used to spend customers’ loyalty points. No misuse of personal information or unauthorised use of loyalty points linked to this incident had been confirmed at the time of its announcement. The investigation into the cause and full extent of the incident is still ongoing.
Although a confirmed data leak has not been established, the incident raises concerns about how cybercriminals could misuse personal information if it falls into the wrong hands. Names, email addresses and phone numbers can be used to create convincing phishing messages, fraudulent calls and fake emails. The company has advised customers to remain alert to suspicious emails, text messages and phone calls. Customers should avoid opening unfamiliar links or attachments and should never share sensitive information in response to unexpected requests.
Daiichi Kosho has said it will continue monitoring the situation and checking its systems as a precaution. It is also reviewing how it manages external service providers and working to understand the incident and prevent similar problems in the future. The case highlights the security risks organisations face when third-party companies handle customer information. Even when a company’s own systems show no signs of compromise, data stored on an external provider’s computer can still create a potential security risk.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
