Daiichi Kosho, Japan's leading entertainment systems manufacturer, announced that a malware compromise at its data handling partner Nippon Columbia Group (NCG) has resulted in the exposure of more than 8.7 million customer and employee records.

Daiichi Kosho operates 521 karaoke venues across Japan and holds the position of the country's largest karaoke operator. The company's portfolio includes the Big Echo chain, among Japan's most recognized karaoke box establishments. The firm outsources personal information management for its customers to NCG, an entertainment conglomerate involved in music, video and game software production, distribution, and artist representation.

NCG notified Daiichi Kosho on October 5 of malware detected on an employee workstation. The affected system was isolated the following day. Daiichi Kosho states that its own infrastructure was not compromised, and the company has found no confirmed evidence of data theft or unauthorized disclosure to date, though it is urging customers to exercise caution given the potential exposure.

Exposed Data

The breach encompasses records for 93,000 employees alongside 8,631,000 customers. The exposed information includes:

  • Full names
  • Genders
  • Dates of birth
  • Email addresses
  • Telephone numbers

The incident potentially affects patrons of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining establishments. Daiichi Kosho notes that exposed records do not contain passwords, and there is no indication of unauthorized access to loyalty point balances.

Investigation and Recommendations

NCG has reset passwords and other authentication credentials across affected systems and is working to determine the incident's root cause and full scope, including whether information has surfaced on public channels. Daiichi Kosho recommends customers remain alert to unsolicited contact through email, SMS, or telephone that solicits payments or sensitive personal or financial details.

A Friday update from Daiichi Kosho did not provide new information regarding potential data leakage. BleepingComputer has not identified a public statement from NCG regarding the security incident and has requested additional details from the organization.