News Date: 2026-10-11
Japanese entertainment company Daiichi Kosho is investigating a major privacy incident after malware was discovered on an employee computer at contractor Nippon Columbia Group. The affected contractor handled customer information for Daiichi Kosho, which operates prominent karaoke brands including BIG ECHO, MEGA BIG, Karaoke CLUB DAM and Banana Club.
Millions of records placed at risk
The potentially exposed information covers approximately 8.63 million customers and 93,000 employees. The records may contain names, dates of birth, gender, email addresses and telephone numbers. Daiichi Kosho said passwords were not included, and it has found no evidence that loyalty points were misused.
The company also emphasized that its own systems were not breached. Nippon Columbia detected malware on an employee computer on October 5 and isolated the affected system the following day. Authentication credentials were subsequently reset while investigators worked to determine the infection's origin, scope and possible consequences.
No data theft or public leak had been confirmed at the time of reporting. That distinction matters, but organizations should not interpret the absence of confirmed exfiltration as proof that information remained secure. Attackers frequently collect data quietly, and evidence may not become visible until records appear in phishing campaigns, criminal marketplaces or identity fraud operations.
The broader third-party lesson
I believe the most important issue is the concentration of customer information inside a contractor environment. A supplier may appear to perform a limited business function while quietly holding millions of records that make it as attractive as the primary company.
Organizations should respond by strengthening several controls:
- Maintain an accurate inventory of information shared with every supplier.
- Require endpoint monitoring, rapid incident notification and independent security assessments.
- Limit contractor access and retention to the minimum operational requirement.
- Use contractual controls covering investigation support, breach reporting and secure deletion.
- Prepare joint incident-response procedures before a compromise occurs.
Customers should remain alert for unsolicited calls, text messages and emails that use accurate personal details to appear convincing. In my view, the long-term solution is not simply better malware detection. Companies must reduce the amount of personal information copied into external environments and continuously verify how suppliers protect it.