INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Karaoke Giant Discloses Data Breach Affecting Eight Million Users

| 2026-10-12 08:35 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A data breach at a supplier of Japanese entertainment group Nippon Columbia Group (NCG) may have exposed personal information of over eight million customers, including names, genders, dates of birth, email addresses, and telephone numbers. The incident occurred between October 1 and October 2, 2026, when malware was discovered on one of an employee's devices, which was then isolated from the network. Daiichi Kosho, a karaoke box operator with several popular brands, claims that personal data related to work outsourced to them may have been leaked. The majority of those impacted by the potential breach are customers of Big Echo (5.6 million) and DK Dining brands (3.5 million). As part of their response, Daiichi Kosho has urged customers to be on the lookout for possible phishing attempts using this personal information.
Technical Mitigations AI-generated
• Isolate employee devices from the network immediately after discovering a malware infection. • Regularly monitor for phishing attempts using personal information leaked in data breaches, and block suspicious emails, SMS messages, and phone calls. • Use strong passwords and enable two-factor authentication to prevent unauthorized access to accounts.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA transportationtransportation
Incident Timeline
‎2025/10/12
Threat actors used ransomware to target Asahi Group Holdings, resulting in a major disruption of operations.
tactic Ransomware
Last year a major ransomware attack on food and beverage giant Asahi Group Holdings severely disrupted operations.
organisation Asahi Group Holdings
Last year a major ransomware attack on food and beverage giant Asahi Group Holdings severely disrupted operations.
‎September 25
Threat actors used ransomware to target Times Car's website, resulting in the compromise of personal information on 6.6 million members and former members.
tactic Ransomware
At around the same time, Keio Corporation revealed a ransomware attack, although it’s not clear whether any data was compromised. Car-rental company Times Car announced on September 25 that an unauthorized third party gained access to its website, leading to the compromise of personal information on 6.6 million members and former members.
organisation Keio Corporation
At around the same time, Keio Corporation revealed a ransomware attack, although it’s not clear whether any data was compromised. Car-rental company Times Car announced on September 25 that an unauthorized third party gained access to its website, leading to the compromise of personal information on 6.6 million members and former members.
organisation Times Car
At around the same time, Keio Corporation revealed a ransomware attack, although it’s not clear whether any data was compromised. Car-rental company Times Car announced on September 25 that an unauthorized third party gained access to its website, leading to the compromise of personal information on 6.6 million members and former members.
data_breach 6.6 members
At around the same time, Keio Corporation revealed a ransomware attack, although it’s not clear whether any data was compromised. Car-rental company Times Car announced on September 25 that an unauthorized third party gained access to its website, leading to the compromise of personal information on 6.6 million members and former members.
‎October 1
A malware infection was discovered on an employee's PC between October 1 and October 2, 2026.
organisation the Self Defense Forces
A new Active Cyber Defence law which came into force on October 1 will empower the Self Defense Forces (SDF) and police to proactively access and neutralize hostile foreign servers, but it may do little to improve cybersecurity posture in regular organizations, especially SMBs.
organisation SDF
A new Active Cyber Defence law which came into force on October 1 will empower the Self Defense Forces (SDF) and police to proactively access and neutralize hostile foreign servers, but it may do little to improve cybersecurity posture in regular organizations, especially SMBs.
‎October 2, 2026
Threat actors used malware to infect a PC belonging to an employee of Karaoke Giant, potentially exposing the personal data of approximately 8.724 million customers.
industry Transportation
General Document Context
organisation Banana Club
Other affected businesses include Mega Big, Banana Club, Karaoke Club Dam and B-Garage.
organisation Subway
Subway operator Tokyo Metro said an unauthorized third party had accessed the email addresses of 59,000 passengers signed up to its Metpo loyalty scheme.
victims 8,724,000 customers
“Based on the information we currently have, approximately 8,724,000 customers who registered or made reservations at our stores may have had their names (registered names), genders, dates of birth, email addresses, and telephone numbers leaked to external parties,” it warned.
‎October 2
A malware infection was discovered on an employee's PC between October 1 and October 2, leading to the device being isolated from the network.
‎October 5
NCG received a report on October 5 detailing the impact of a data breach affecting eight million users.
‎October 8
Nippon Columbia Group published a statement on October 8 claiming an incident at NCG resulted in the exposure of customer information for eight million individuals.
organisation Nippon Columbia Group
It published a statement on October 8 claiming an incident at Nippon Columbia Group (NCG), a Japanese entertainment group which handles customer information for the firm.
organisation NCG
It published a statement on October 8 claiming an incident at Nippon Columbia Group (NCG), a Japanese entertainment group which handles customer information for the firm.
source_region Japan
It published a statement on October 8 claiming an incident at Nippon Columbia Group (NCG), a Japanese entertainment group which handles customer information for the firm.
‎2026/10/12
Threat actors exploited a supplier's vulnerability, potentially exposing personal information of over eight million customers.
organisation Karaoke Giant Reveals Data Breach
Karaoke Giant Reveals Data Breach Impacting Eight Million.
organisation Daiichi Kosho
Daiichi Kosho has several popular brands including Big Echo, one of the country’s largest karaoke box chains, and also manufactures karaoke entertainment systems.
Tactical Metrics
Metrics
data_breach
6,600,000
Members
At around the same time, Keio Corporation revealed a ransomware attack, although it’s not clear whether any data was compromised. Car-rental company Times Car announced on September 25 that an unauthorized third party gained access to its website, leading to the compromise of personal information on 6.6 million members and former members.
Metrics
victims
8,724,000
Customers
“Based on the information we currently have, approximately 8,724,000 customers who registered or made reservations at our stores may have had their names (registered names), genders, dates of birth, email addresses, and telephone numbers leaked to external parties,” it warned.
Intelligence Sources
Infosecurity-Magazine 2026-10-12