Japanese karaoke company Daiichi Kosho has warned that personal information belonging to approximately 8.7 million customers and employees may have been compromised following a malware infection at an external service provider. The incident involves Nippon Columbia Group, which processes personal data on behalf of the entertainment company.
The potential exposure affects approximately 8.63 million customer records and 93,000 employee records. Daiichi Kosho emphasized that investigators have not confirmed any unauthorized disclosure or misuse of the information.
The security incident was discovered between October 1 and October 2, 2026, when malware was detected on a Nippon Columbia employee’s computer. The affected device was disconnected from the network on October 2, and Daiichi Kosho received notification of the incident on October 5.
The computer had temporarily stored personal information associated with services provided to Daiichi Kosho. Because investigators cannot rule out unauthorized access to those files, the company issued a public warning on October 8.
Potentially affected information includes customers’ names, gender, dates of birth, email addresses, and telephone numbers. The records belong to people who registered for memberships or made reservations through Daiichi Kosho’s entertainment businesses.
The largest portion involves approximately 5.56 million records associated with Big Echo, one of Japan’s best-known karaoke chains. Other potentially affected customers used services including Mega Big, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining.
Daiichi Kosho operates hundreds of karaoke venues across Japan and also supplies karaoke equipment and entertainment systems. Nippon Columbia Group, meanwhile, has business activities spanning music production, entertainment distribution and related services.
The company confirmed that passwords were not included in the potentially exposed customer information. It also reported no evidence that loyalty points had been used fraudulently and said its own systems had not been affected by the malware incident.
Nippon Columbia has reset relevant authentication credentials while working with external specialists to determine how the infection occurred and whether personal information was accessed or transferred outside its systems.
The company has established a dedicated customer support channel and is reviewing its oversight of external service providers. Further notifications may follow if investigators identify additional affected individuals or confirm that information was stolen.