Daiichi Kosho Breach May Expose 8.6M Big Echo Karaoke Customers

If you have ever booked a room at Big Echo or joined a DK Dining loyalty scheme, your name, birth date, email address and phone number may be sitting on a list somebody else now holds. Daiichi Kosho has not confirmed that anyone took it. What it has confirmed is that one PC at its contractor, Nippon Columbia Group, held the data and was infected with malware.

Below: what the primary notices actually say, translated from the Japanese (quotes from Japanese sources are our translations), where English coverage drifted, and what the follow on phishing could look like in your inbox.

Key Takeaways

• Daiichi Kosho said on October 8, 2026 that about 8,724,000 records may have leaked, made up of about 8,631,000 customer records and about 93,000 employee records.
• Nippon Columbia Group, which handles customer data for Daiichi Kosho, found malware on one employee PC between October 1 and 2, isolated it on October 2 and reported to Daiichi Kosho on October 5.
• The fields at risk are registered name, gender, date of birth, email address and phone number; Daiichi Kosho says passwords are not included and no misuse of points has been confirmed.
• Big Echo accounts for about 5,558,000 of the customer records and DK Dining for about 3,462,000, before roughly 515,000 duplicates are removed.
• Daiichi Kosho warns the data could be used for spoofed emails and phishing, and says it will never ask customers for a password or credit card number.

What Happened at Daiichi Kosho?

A contractor PC holding Daiichi Kosho customer data was infected with malware, and the company cannot rule out that the data left it. The October 8 notice from Daiichi Kosho (in Japanese) gives this sequence:

• October 1 to 2, 2026: Nippon Columbia Group (NCG) finds malware on one employee PC.
• October 2: NCG cuts that PC off from its network.
• October 5: after scoping the impact, NCG reports to Daiichi Kosho.
• October 8: Daiichi Kosho publishes the notice.
• October 9: a second notice opens a toll free line, 0120-732-079, and repeats that no misuse has been confirmed.

The PC "temporarily stored" personal data from the work Daiichi Kosho outsourced to NCG, the notice says. NCG has reset passwords and other authentication credentials and is still investigating the cause and whether anything leaked. Daiichi Kosho says its own systems were not affected. Neither notice names the malware or how it got onto the machine.

Which Brands and How Many Records?

Six store brands are involved, and two of them account for nearly all the records. The notice's table, all figures approximate:

• Karaoke Big Echo: 5,558,000
• DK Dining (restaurants): 3,462,000
• Karaoke CLUB DAM: 74,000
• Mega Big: 43,000
• Banana Club: 5,000
• B-GARAGE: 4,000
• Duplicates removed: minus 515,000, for a customer subtotal of 8,631,000
• Employees: 93,000, for a total of 8,724,000

By our arithmetic, Big Echo is about 61% of the customer rows before deduplication and DK Dining about 38%, so this is mostly a karaoke and restaurant booking list. The two headline numbers in English coverage both hold, as long as you keep them apart. BleepingComputer uses 8.6 million in its headline, which is customers only, and more than 8.7 million in its opening line, which adds employees. BleepingComputer also puts Daiichi Kosho's network at 521 karaoke venues.

Was the Data Actually Stolen?

Not as far as anyone has confirmed. The Japanese wording is a leak "おそれ", a risk of leakage, and Daiichi Kosho says it has found no actual external leak and no unauthorized use. Japanese coverage, including Impress Internet Watch, reports it the same way. BleepingComputer says it could not find a public statement from NCG and had asked the company for one. No group has claimed the attack in any source we read.

Most of the coverage leads with the 8.6 million. The more useful detail for anyone running a vendor program is the single PC. One employee machine at a processor held a working copy of a customer list with millions of rows, and Daiichi Kosho learned about it three days after the device was isolated. The company says it will review how it manages contractors and strengthen oversight.

Has Nippon Columbia Been Hit Before?

A company in the same group was, 15 months earlier. Nippon Columbia Co., Ltd. found on July 17, 2025 that its servers had been accessed without authorization. Its March 31, 2026 findings say investigators found no direct trace of data leaving, but could not rule out that a third party viewed it. The data sets at risk then were small, including 3,093 records of HR information and 152 records on officers and staff of Faith Inc. and Nippon Columbia Group Co., Ltd.

The two incidents involve different legal entities and different data, and no source links them technically. The contrast in disclosure is still worth noting. That earlier notice says Nippon Columbia reported to the Personal Information Protection Commission and filed a police report. Neither Daiichi Kosho notice mentions either; the October 9 update says only that the company is working with "relevant organizations."

What Does Japanese Privacy Law Require Here?

A possible leak affecting more than 1,000 people has to be reported to the regulator and to the people affected. The Personal Information Protection Commission says that since April 1, 2022, a leak or a risk of leak in one of four categories, one of which is more than 1,000 people, triggers a report to the commission "promptly (roughly within 3 to 5 days)" and notice to individuals. The rule covers the risk, not only the confirmed theft, which is why a notice like this one appears before anyone knows what happened.

Whether Daiichi Kosho or NCG has filed is not public. For comparison, we covered how Aflac's Japan subsidiary lost bank account data in June, and how U.S. Bank traced its breach to a contractor of a vendor. The pattern is the same: the brand customers trust is not the company that held the copy that got hit.

Why Email Users Should Care

Name, email, phone and date of birth, tied to a brand you actually use, is enough to write a message that sounds like it came from Big Echo. Daiichi Kosho says so itself: if the data leaked, it "could be misused for spoofed emails and phishing scams," and customers should watch for suspicious emails, SMS and phone calls.

Japan's phishing volume gives that warning weight. The Council of Anti-Phishing Japan's August 2026 report counted 82,338 phishing reports that month, up 16,219 from July. In its test inbox, about 67.7% of phishing emails came from the attackers' own domains rather than spoofed ones, and about 94.2% of those passed DMARC. A clean authentication result tells you who sent a message, not whether it is honest. The council also says SMS phishing reports remain low but keep arriving, posing as utilities, Apple and card companies.

No Daiichi Kosho themed campaign has been reported. If one appears, the obvious hooks are the ones customers would expect to hear about after a breach: an apology with compensation or bonus points, a warning that points are about to expire, a request to re register a membership, or a booking confirmation for a room you never reserved. Daiichi Kosho has already defused the most dangerous version: it says it will never ask for a password or credit card details, and that the leaked fields alone cannot be used to spend your points.

How to Check a Message That Claims to Be From Daiichi Kosho

Treat any message about this incident as unverified until you reach the company through a channel you looked up yourself.

1. Go to dkkaraoke.co.jp by typing it. Real updates appear on the company's news page; as of October 12, the two notices above are the only ones we found.
2. Use the phone number from the notice, not the email. The toll free line is 0120-732-079, weekdays 10:00 to 17:00, and the inquiry address is incident-desk@dkkaraoke.co.jp. A message that gives you a different number is a red flag.
3. Never type a card number or password in response. Daiichi Kosho has said in writing it will not ask for either.
4. Be wary of anyone who quotes your birth date back to you. Knowing it proves nothing now; it may be in the exposed data.
5. Report the fake. Gmail's help page says to open the message, click More next to Reply, then click Report phishing. It also advises you to "Check that the email address and the sender name match."

The same checklist applied to the Sakura Internet breach in August, where contact data rather than cards was the exposure.

What Should Security Teams Take From This?

The control that failed here sits on an endpoint, not on a server. A few questions worth asking of your own processors, drawn from the facts in the Daiichi Kosho notice:

• Where do working copies live? A contract can require data to stay in a managed system, but a laptop export of millions of rows defeats that unless someone checks.
• How fast must the vendor tell you? Three days passed between isolation and notice here, and the regulator's guide for the initial report is roughly three to five days from when you learn of it.
• What gets reset, and by whom? NCG reset credentials on its side. Ask whether any shared accounts or API keys between you and the vendor need rotating too.
• Who writes to customers? Decide in advance, so customers hear one consistent message, with one phone number, before the scammers send theirs.