# Nippon Columbia Group contractor malware incident exposes ~8.72M Daiichi Kosho (BIG ECHO / Karaoke CLUB DAM) customer and employee records

> Malware was found on a single employee PC at Nippon Columbia Group (NCG), a contractor handling personal data for karaoke operator Daiichi Kosho. About 8,724,000 records (8,631,000 customer and 93,000 employee) containing names, gender, date of birth, email addresses and phone numbers may have been exposed; no actual leak or misuse has been confirmed.

- **Published:** 2026-10-11T14:42:46Z
- **Last reviewed:** 2026-10-11T14:42:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3312
- **ID:** TL-2026-3312
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Daiichi Kosho, operator of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining, announced on 2026-10-08 that malware had been detected on one employee terminal at its personal-data processing contractor, Nippon Columbia Group (NCG). Per the Daiichi Kosho notice and Japanese press coverage (Impress Internet Watch, Rocket Boys), the infection was identified on 2026-10-01/02 and the device was isolated from the network on 2026-10-02. Daiichi Kosho was notified by NCG on 2026-10-05 and disclosed publicly on 2026-10-08. BleepingComputer, which the hunt skeleton cites, reports discovery on 2026-10-05 and isolation on 2026-10-06; this is a discrepancy with the primary Japanese sources, which are treated as authoritative here and likely reflect the date Daiichi Kosho was told.

The potentially exposed data was customer and employee information that had been temporarily stored on the infected terminal. Fields are registered name, gender, date of birth, email address and telephone number. Passwords are not included, and no unauthorized use of loyalty points has been detected. Per-brand counts in the Daiichi Kosho notice: BIG ECHO ~5.558M, DK Dining ~3.462M, Karaoke CLUB DAM ~74K, MEGA BIG ~43K, Banana Club ~5K, B-GARAGE ~4K, employees ~93K, less ~515K duplicate records, for ~8.724M in total. The BleepingComputer URL slug says 86 million, but its article text and the primary sources give 8.631M customers plus 93K employees.

NCG has reset passwords and authentication credentials for the terminal and systems, and is working with external specialists to establish the infection cause and the effect on personal data. NCG states a leak cannot be ruled out. Daiichi Kosho says its own core systems were not affected, has started security audits and a review of vendor management, and warns customers about phishing and fraudulent emails or calls.

No malware family, infection vector, threat actor, CVE or network indicators have been published. Severity (MEDIUM) is analyst-assigned. The ATT&CK mappings below are low-confidence and inferred from the incident type (third-party compromise, endpoint malware, customer data staged on the endpoint, exfiltration not confirmed, credential reset). The vector, valid-account abuse and exfiltration are not source-confirmed. The IOCs are entity and behavioral indicators only, because no technical IOCs were disclosed.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1204 User Execution
- T1078 Valid Accounts
- T1005 Data from Local System

## Sources

- [Nippon Columbia malware incident exposes 8.6 million karaoke fan records (BleepingComputer)](https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/)
- [Daiichi Kosho notice on malware infection at contractor (official)](https://www.dkkaraoke.co.jp/news/newsletter/261008_2.html)
- [Daiichi Kosho / Japan Columbia malware incident report (Impress Internet Watch)](https://internet.watch.impress.co.jp/docs/news/2147032.html)
- [Daiichi Kosho Columbia malware 8,724,000 records data breach risk (Rocket Boys)](https://rocket-boys.co.jp/security-measures-lab/daiichikosho_columbia_malware_8724000_data_breach_risk/)
- [More Firms in Japan Hit by Large-Scale Data Breaches (Nippon.com / Jiji)](https://www.nippon.com/en/news/yjj2026100900441/)
- [Daiichikosho: data on 8.7M customers may have been leaked after contractor malware incident (Newsquawk)](https://www.newsquawk.com/headlines/daiichikosho-7458-jt-notes-that-data-related-to-87mln-customers-may-have-been-leaked-following-a-malware-incident-at-a-contractor)
- [NHK: Daiichi Kosho, about 8.72M personal records may have leaked via contractor malware](https://news.web.nhk/newsweb/na/nd-20261008de56831)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3312