Daiichi Kosho discloses breach exposing 8.7 million karaoke customer and employee records

TLDR

• Daiichi Kosho, operator of Japan's Big Echo karaoke chain, said malware found on a contractor's computer may have exposed roughly 8.63 million customer records and 93,000 employee records.¹
• The infected device belonged to an employee of Nippon Columbia Group, the subcontractor Daiichi Kosho outsources personal-data handling to; the malware was found between 1 and 2 October and the device was isolated on 2 October.¹
• Exposed data potentially includes names, genders, dates of birth, email addresses and phone numbers across six Daiichi Kosho brands, including Big Echo, Mega Big and Karaoke Club Dam.¹²
• Daiichi Kosho says passwords were not among the exposed data and it has found no evidence of unauthorised point redemption; neither it nor Nippon Columbia has confirmed an actual leak or misuse so far.¹³

Daiichi Kosho, Japan's largest karaoke operator with 521 venues nationwide, said on 8 October that Nippon Columbia Group, the subcontractor it outsources customer-data handling to, had reported a malware infection on an employee's computer that may have exposed personal data on millions of customers and employees.¹ The company said its own systems were not affected and that the incident originated entirely at the contractor.¹

According to Daiichi Kosho's notice, Nippon Columbia found malware on a single employee PC between 1 and 2 October and isolated the device from its network on 2 October, then reported the incident to Daiichi Kosho on 5 October.¹ The breakdown spans roughly 5,558,000 Big Echo-related records, 3,462,000 DK Dining-related records, and smaller counts tied to Mega Big, Karaoke Club Dam, Banana Club and B-Garage, totalling about 8,631,000 customer records after removing roughly 515,000 duplicates, plus about 93,000 employee records.¹² Nippon Columbia has reset passwords and other authentication credentials on the affected systems and is continuing to investigate the cause and scope.¹³

Daiichi Kosho said it has not confirmed that any data was actually leaked externally or misused, but is warning customers to watch for phishing emails, texts and calls that could exploit the exposed contact details, and stressed it will never ask customers for passwords or payment details.¹ BleepingComputer reported it could not locate a public statement from Nippon Columbia itself and had reached out to the company for comment.³

Why it matters: another karaoke-sized customer database, millions of names and birthdates deep, sat on a single infected contractor laptop rather than inside the company that actually markets to those customers, a reminder that outsourcing data handling does not outsource the breach-notification headache.