Daiichi Kosho, Japan's largest karaoke operator, says malware on a contractor computer at Nippon Columbia put personal data for 8,631,000 customers and 93,000 employees at risk. BleepingComputer reported the disclosure on 11 October 2026. The company has not confirmed that the data was stolen.
What happened
Nippon Columbia Group told Daiichi Kosho on 5 October that it had found malware on an employee computer and isolated the machine the next day. Daiichi Kosho outsources customer personal-information handling to NCG. Its own systems were not breached, it says.
The records include full names, gender, dates of birth, email addresses, and telephone numbers. Passwords were not in the set, and the company says it has no evidence of loyalty-point abuse. Venues that may be affected include BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining.
A Friday update did not add proof of a leak. BleepingComputer could not find a public NCG statement and was waiting on one.
Who is affected
- Current and former customers of the named Daiichi Kosho karaoke and dining brands, if their records sat with the contractor.
- About 93,000 employees whose personnel data was in the same store.
- Any company that handed a full customer file to a contractor and cannot say, today, whether that file left the contractor's PC.
What to do now
Treat contractor endpoints that hold customer files as in-scope systems, not someone else's problem. If you outsource a customer database, confirm the processor isolated the host, reset credentials, and can show whether data left. Warn affected people about payment and identity calls. Do not collect a copy of the file "just in case" on an unmanaged laptop.
Source: BleepingComputer, 11 October 2026, citing Daiichi Kosho notices. Read the report.
Also on the blog
- CyberXero used Claude Code to steal 628,000 Ukrainian records
- Edward Dubrovsky arrested in Pennsylvania extortion case
- FortiBleed still holds 86,644 Fortinet device credentials
- Fake Claude ads hide a ClickFix command behind Bing
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.