Short answer

Daiichikosho, operator of Big Echo karaoke and DK Dining, said on 8 October 2026 that malware on one PC at its contractor Nippon Columbia Group may have exposed about 8.72 million records. The company has not confirmed that data actually left the PC.

If you think your details were included, start with our checklist on what to do after a data breach.

Key facts

Key facts about the Daiichikosho Co., Ltd. (via Nippon Columbia Group) incident
OrganizationDaiichikosho Co., Ltd. (via Nippon Columbia Group)
Incident typeData breach
StatusUnder investigation
SectorKaraoke and restaurants
CountryJapan
Detected2026-10-02
Disclosed2026-10-08
People or records affectedAbout 8,724,000 records (about 8.63 million customer records and 93,000 employee records), as a possible exposure

What data was exposed

  • Registered name
  • Gender
  • Date of birth
  • Email address
  • Phone number

What happened

Daiichikosho runs Big Echo karaoke rooms, the DAM karaoke machine network and the DK Dining restaurants. On 8 October 2026 it disclosed that customer data it had handed to a contractor, Nippon Columbia Group, may have been exposed.

According to the company, malware was found between 1 and 2 October on one PC used by a Nippon Columbia employee. The PC was cut off from the network on 2 October. Nippon Columbia told Daiichikosho on 5 October. The PC had temporarily held personal data for work the karaoke firm had outsourced.

The numbers

The notice gives about 8,631,000 customer records and 93,000 employee records, for a total of about 8,724,000. Press reports quoted different splits, so we use the company’s own table. The brand breakdown is in the FAQ below. Duplicates across brands were removed from the customer total.

What the company says and does not say

Daiichikosho states that it has not confirmed any actual leak outside the PC, and it has found no misuse of points. Nippon Columbia has reset passwords and credentials and is still working out the cause and the extent of the damage, including whether anything was copied. The data does not include passwords. The company says it will review the contractor’s findings and tighten oversight of outsourced work.

An addendum dated 26 October added that individual SMS notices were going to people who may be affected. That detail matters because customers are now used to getting a text about this incident, which is exactly what a scammer can copy.

Why this one is a scam magnet

Names, birth dates, emails and phone numbers are the raw material for targeted phishing. Karaoke and restaurant loyalty programmes are used by many people, so a fake “your points are expiring” text will land with some of them. Our guides on phishing messages and toll and delivery text scams show how these messages are built, and the data breach checklist lists the steps in order.

What is still unknown

Not yet public: how the malware reached the PC, what kind of malware it was, and whether the data left the machine. Watch the company’s page and our breaches index for changes. See the editorial policy for how we handle unconfirmed claims.

Scams to watch for after this breach

Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.

  • Phishing emails and SMS pretending to be Big Echo, DK Dining or the DAM point service.
  • Phone calls that quote your name and birth date to appear legitimate.
  • Fake notices of a point balance or expiry asking you to log in.
  • Copycat messages imitating the company's own breach notification SMS.

What to do if you are affected

  1. 01Treat any message about this incident with care. The company sends individual SMS notices, but the sender number alone does not prove a message is genuine.
  2. 02Do not open links or attachments in unexpected emails or SMS that mention Big Echo, DK Dining or points.
  3. 03Check your account only by typing the official address or using the official app. The company says it will never ask for passwords or card numbers.
  4. 04Use the company's inquiry line for questions: 0120-732-079, 10:00 to 17:00 on weekdays.
  5. 05Report suspicious calls to police consultation line #9110 and consumer matters to the hotline 188.

Frequently asked questions

Was Big Echo's own system hacked?

No, according to the company. The malware was found on one PC used by an employee of its contractor, Nippon Columbia Group. Daiichikosho says its own systems were not affected.

Were passwords or card numbers exposed?

The company says passwords are not in the data and that the exposed fields alone cannot be used to redeem DK points. No card data is listed.

Has the data been confirmed stolen?

Not as of the company's notice. It says no actual external leak or misuse has been confirmed, only that a leak cannot be ruled out.

Which brands are involved?

Big Echo (about 5.56 million records), DK Dining (about 3.46 million), Karaoke CLUB DAM (74,000), Mega Big (43,000), Banana Club (5,000) and B-Garage (4,000). About 515,000 duplicates were removed from the customer total.

Did I get an SMS about this?

The company began sending individual SMS notices in October 2026. It says these do not signal a new leak, and notes the sender numbers 05036052572 for Docomo, au and Rakuten Mobile, and 247473 for SoftBank.

Sources

  1. Notice on possible leak of personal information at a contractor (Daiichikosho, Japanese), Daiichikosho, 2026-10-08
  2. 第一興商、委託先への不正アクセスで「ビッグエコー」などの利用者情報約872万件が漏えいのおそれ (Daiichikosho says about 8.72 million user records may have leaked after unauthorized access at a contractor), INTERNET Watch, 2026-10-09
  3. 第一興商の委託先 日本コロムビアグループでマルウェア感染 (Malware infection at Daiichikosho contractor Nippon Columbia Group), ScanNetSecurity, 2026-10-14

This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.