Nippon Columbia Group malware incident may expose records of over 8.7 million people

Japanese karaoke company Daiichi Kosho says personal information handled by Nippon Columbia Group (NCG), its contractor, may have been exposed after malware infected a device used by an NCG employee. The company has not confirmed that information was leaked externally or misused, according to a machine-translated notice cited by TechRadar.

The notice says NCG reported the infection on October 5, 2026, and isolated the affected systems the following day. Daiichi Kosho said its own systems were not affected. It suspects records for 93,000 employees and 8,631,000 customers may have been exposed. The records may include full names, gender, dates of birth, email addresses and telephone numbers.

Customers of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining may be among those affected. The notice did not disclose passwords, loyalty points or payment data, and said there was no evidence the data had been misused on the dark web.

Daiichi Kosho urged employees and customers to be wary of incoming emails, particularly unsolicited messages claiming to come from the company. It said it is monitoring the situation, inspecting other systems and reviewing how it manages contractors. The company said it would provide an update if its investigation finds new facts, including which customers were affected and what measures it will take.