Daiichi Kosho Reports Malware Infection at Outsourcing Partner, Potentially Exposing Millions of Personal Records
Japanese karaoke operator Daiichi Kosho has recently alerted the public about a malware infection linked to its outsourcing partner, Nippon Columbia Group (NCG). This alarming incident may have compromised approximately 8.72 million personal records, raising significant concerns regarding data privacy and security.
The type of data potentially exposed encompasses not only customer information but also employee records, marking a broad range of affected personal information. As of now, investigations are underway, yet no evidence has surfaced confirming data theft or misuse, signifying the importance of a thorough inquiry into the situation.
On October 8, 2026, the company disclosed the incident, revealing that NCG is tasked with managing personal data for Daiichi Kosho’s numerous business ventures, including well-known chains such as BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining. It is crucial to note that the concerns extend primarily to the data that was entrusted to NCG and not to any verified breach within Daiichi Kosho’s own systems.
According to a statement cited by Infosecurity Magazine, NCG discovered the malware on an employee’s computer between October 1 and October 2. Swift action was taken to isolate the infected device from the network by October 2, with Daiichi Kosho receiving NCG’s findings on October 5. This quick response might have helped to mitigate potential damage from the malware infection.
The malware incident involved personal information connected to outsourced activities being temporarily stored on the infected computer, raising concerns about potential exposure. However, investigators have not yet determined the extent to which attackers may have accessed or exfiltrated any data. Distinguishing between potential exposure and confirmed data exfiltration remains a key focus of the ongoing investigation—a critical step in assessing the impact of this incident.
Reports suggest that the potentially affected dataset includes around 8,631,000 customer records and 93,000 employee records. The customer information may consist of registered names, genders, dates of birth, email addresses, and telephone numbers. Notably, the data did not include any passwords, and Daiichi Kosho has not reported any unauthorized usage of loyalty points.
In response to the incident, NCG has acted proactively by resetting passwords and other authentication credentials while diligently investigating the cause and scope of the infection and any potential data leakage. Meanwhile, Daiichi Kosho has confirmed that its own systems remained secure, with no signs of unauthorized access.
The company has urged its customers to remain vigilant against suspicious emails, SMS messages, and phone calls that may exploit the exposed personal details. To protect themselves, customers have been advised not to click on unfamiliar links or open attachments and to be cautious of any requests for passwords or credit card information. These measures are particularly relevant in light of potential phishing attempts that could arise from the incident.
To assist wary customers, Daiichi Kosho has set up a dedicated toll-free hotline, available from 10:00 a.m. to 5:00 p.m., excluding weekends and public holidays. For those unable to connect via phone, an email contact has also been provided. The company remains committed to reassuring customers that, as of now, there has been no confirmed misuse of the exposed data.
Furthermore, Daiichi Kosho has pledged to continue its investigation in cooperation with relevant organizations, underlining its commitment to data security and customer protection in light of this significant incident. Updates from the company will likely provide more information as investigations progress.
As this situation unfolds, it serves as a stark reminder of the potential vulnerabilities that exist within outsourced operations, particularly regarding sensitive personal data. Ensuring updated defenses against new malware and adopting preventative measures will be crucial in the ongoing battle against cyber threats.