-
Malware infected one computer at Nippon Columbia Group, a contractor that held customer data for Daiichi Kosho, the company behind Big Echo karaoke.
-
About 8.72 million records may be exposed. They include names, genders, birth dates, email addresses and phone numbers, but no passwords.
-
No leak or misuse has been confirmed. The biggest risk is phishing emails, texts and calls that use these personal details.
Daiichi Kosho, Japan’s largest karaoke company, said in an October 8 newsletter that the personal data of millions of people may have leaked. Its own systems were not hit. The trouble started at a company it hired to handle some of that data.
The firm says it cannot rule out a leak. It also says it has no proof that any data left the contractor’s network.
Malware Detected on an Employee’s Computer
Nippon Columbia Group, known as NCG, found malware on one employee’s computer between October 1 and October 2. NCG cut that computer off from its network on October 2.
NCG then reviewed the damage. On October 5, it told Daiichi Kosho what it had found. Daiichi Kosho went public three days later.
The computer had held personal data from work Daiichi Kosho had handed to NCG. That is why the karaoke company is warning people now. So far, only that one computer is confirmed as infected.
The Scope of the Exposure
The notice covers about 8,724,000 records. Of those, roughly 8,631,000 belong to customers. About 93,000 belong to employees.
Customer records are spread across several brands:
- Big Echo: about 5.56 million
- DK Dining: about 3.46 million
- Karaoke Club DAM: about 74,000
- Mega Big: about 43,000
- Banana Club: about 5,000
- B-Garage: about 4,000
Those brand numbers add up to more than the customer total. The company says it removed about 515,000 duplicate records. It is common for people to use multiple brands so that one person’s record may show up in various places.
The data contains the name, gender, date of birth, an email address, and a phone number. All these are enough for a scammer to make the message seem legitimate. A fake text could greet you by name. A caller could quote your birthday. Either one makes a trick easier to believe.
Daiichi Kosho says no passwords were in the data. It also says the data alone cannot be used to spend loyalty points. So far, it has seen no sign that anyone has misused points.
The company adds that it never asks customers for passwords or credit card numbers. Any message that does is fake.
Some Key Details Remain Unclear
Big questions remain. NCG has not said how the malware got onto the computer. No hacker group has claimed the data, and none has been named. As of October 12, we also found no public statement from NCG.
The notice does not say what work Daiichi Kosho gave NCG. It also does not say how long the data sat on that one computer.
Daiichi Kosho has promised to share new facts quickly. That includes any change in who is affected.
How the Companies are Responding
NCG reset passwords and login credentials. It is now working with outside experts to find the cause, the size of the problem, and whether anything leaked.
Daiichi Kosho says it is watching for signs of misuse. It is also double-checking its own systems. The company plans to review how it manages its outside partners and tighten controls where needed.
Japan is also taking broader steps to strengthen its cybersecurity defenses, with a new policy aimed at detecting threats earlier, as reported in a report that Japan approves a new cybersecurity policy to detect cyber threats earlier.
The firm apologized for the worry and trouble. It opened a help desk at 03-3280-3702, open 10:00 to 17:00 on business days, Japan time. Customers can also email [email protected]. They’re also setting up a toll-free line.
What Customers Should Do
The company’s main advice is simple. Beware if messages, emails, texts, or phone calls that seem odd. Avoid opening unknown links or files. Some extra steps are smart after any data leak:
- Do not tap links in messages that mention Big Echo, DK Dining or your points. Go directly to visit their official site or app.
- Hang up on any caller requesting your personal information. Call back using a number from the company’s website.
- Never share your password, OTP, or credit card info to anyone asking for it via a message or call.
- Be on the lookout for unexpected messages in the coming months. Scammers often wait before they use stolen data.
This case shows how one weak spot at a partner can reach millions. Daiichi Kosho says its own systems held up. Even so, its customers now face the risk.
For now, this is a possible leak, not a confirmed one. That could change as NCG finishes its probe. If you have a Big Echo or DK Dining account, stay alert.
