57 minutes ago
1
- Malware infection at a third-party contractor may have exposed data of 8.7 million customers and employees
- Exposed records included personal details, though no payment data or confirmed misuse was reported
- Incident highlights supply-chain risks, with Daiichi Kosho investigating and reviewing contractor security
Even the entertainment industry is not safe from data-stealing cybercriminals - Daiichi Kosho, one of the biggest entertainment system makers in Japan, has disclosed a malware infection in its supply chain that may have resulted in the compromise of 8.7 million of both customer and employee information.
“Daiichi Kosho has received a report from Nippon Columbia Group (NCG), to which the Company outsources the handling of personal information, that a device used by an NCG employee was infected with malware and that the company’s customer information may have been leaked,” a machine-translated data breach notification letter reads.
“At this time, we have not confirmed that personal information was actually leaked externally or that it was misused as a result of this incident. However, as we cannot rule out the possibility that personal information was leaked, we are providing the information currently available and the actions we will take, as follows. We have also confirmed that the company’s systems were not affected.”
Supply chain attack
The wording is intentionally ambiguous - as this is obviously a supply chain attack, since Daiichi Kosho was not directly compromised.
Instead, it was Nippon Columbia Group, a group formed in 2025 after a restructuring of Faith. Nippon’s roots date back to 1910, when its predecessor became Japan’s first record company. Today, Faith established Nippon Columbia Group as a new organization focused on AI-powered entertainment and content distribution.
Daiichi Kosho, on the other hand, is one of Japan’s leading karaoke and entertainment companies. It was founded in 1973 and is today best known for its DAM karaoke systems and Big Echo karaoke venues. In fact, the company today runs more than 400 karaoke venues across Japan, including more than 100 in Tokyo alone.
The company both sells and rents karaoke gear, runs establishments and restaurants, and produces music and videos. Daiichi Kosho is a substantial business, generating roughly ¥163 billion (around $1.06 billion) in annual revenue a year.
Malware infection
According to BleepingComputer, Daiichi Kosho outsources the handling of its customers’ personal information to NCG. On October 5 2026, that company notified Daiichi Kosho that it found a malware infection and isolated the affected systems the day after. We don’t know exactly how the company ended up infected, or what kind of infection it was. What we do know is that it suspects records on 93,000 employees and 8,631,000 customers may have been exposed.
These records contain people’s full names, genders, dates of birth, email addresses, and telephone numbers. Customers of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining, are among those affected by the attack. Passwords, loyalty points, or payment data, were not disclosed, the notice reads. Furthermore, there is no evidence of the data being misused on the dark web.
However, Daiichi Kosho did warn employees and customers to be wary of incoming email messages, especially unsolicited ones claiming to come from the company itself.
Personally identifiable information holds value on the black market because threat actors can use it to launch personalized, highly tailored phishing attacks.
Through these attacks, they can steal login credentials for corporate environments, or deploy infostealers to grab the passwords. That allows them to pivot to corporate IT infrastructure, steal business secrets and other data, and establish persistence. Ultimately, all of this allows the attackers to threaten to release the files to competitors and the public and thus pressure the victims into paying a ransom.
Daiichi Kosho said it will “continue to monitor the situation and take the necessary measures if we detect any signs of unauthorized use.”
It also said that, out of an abundance of caution, it was now inspecting other systems and was examining how it manages its contractors to see if there is room for improvement.
“If further investigation reveals any new facts, we will promptly provide an update, including the customers affected and the measures to be taken,” the machine-translated notice reads.
