Nippon Columbia Malware Infection Puts 8.72 Million Daiichikosho Customer Records at Risk

Japanese karaoke operator Daiichi Kosho has issued a warning about a malware infection at its outsourcing partner, Nippon Columbia Group (NCG), that may have exposed about 8.72 million personal records.

This potential data exposure includes both customer and employee information, not just customer records. As of now, neither data theft nor misuse has been confirmed, and the investigation is ongoing.

Nippon Columbia Malware Infection

The company disclosed the incident on October 8, 2026. NCG is responsible for handling personal information for Daiichi Kosho, which operates businesses such as BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining.

The situation concerns information entrusted to NCG, rather than a confirmed intrusion into Daiichi Kosho’s systems.

According to a company statement cited by Infosecurity Magazine, NCG discovered malware on an employee’s computer between October 1 and October 2. The company isolated the device from the network on October 2, and Daiichi Kosho received NCG’s findings on October 5.

Personal information related to outsourced work was temporarily stored on the affected computer, creating a potential point of exposure.

However, investigators have not yet determined whether attackers accessed or exfiltrated any information. Distinguishing potential exposure from confirmed exfiltration is critical to evaluating the incident.

The potentially affected dataset reportedly includes about 8,631,000 customer records and 93,000 employee records. Customer information comprises registered names, genders, dates of birth, email addresses, and telephone numbers.

Importantly, the data did not include passwords, and Daiichi Kosho has reported no evidence of unauthorized loyalty point usage.

In response, NCG has reset passwords and other authentication credentials while investigating the infection’s cause, scope, and any possible data leakage.

Daiichi Kosho has confirmed that its own systems were not breached. Public reports have not identified the specific malware family, initial infection vector, or responsible threat actor.

Daiichi Kosho has urged customers to be vigilant regarding suspicious emails, SMS messages, and phone calls. The company advised customers not on click unfamiliar links or open attachments.

It emphasized that it would never request passwords or credit card information. These warnings target potential phishing attempts that may use exposed personal details, rather than confirmed instances of fraud.

To assist customers, Daiichi Kosho has established a dedicated toll-free hotline: 0120-732-079. Reception hours are from 10:00 a.m. to 5:00 p.m., excluding Saturdays, Sundays, and public holidays. Customers who are unable to connect by phone can email incident-desk@dkkaraoke.co.jp.

The company reiterated that it has not confirmed any misuse of information and pledged to continue its investigation while cooperating with relevant organizations.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.