Big Echo: malware on a vendor PC may have exposed 8.72 million records — security lessons for SMBs in Japan

Introduction

On October 8, 2026, Daiichikosho (第一興商), owner of the Big Echo karaoke chain and, according to BleepingComputer, Japan's largest karaoke maker, announced that about 8.72 million customer and employee records may have leaked. The most important part of the story is not the size of the number but where the problem started: Daiichikosho's own systems were not breached. The incident began on a single PC used by an employee of a contractor, Nippon Columbia Group (NCG, 日本コロムビアグループ), which was temporarily storing customer data and was infected with malware.

In this article we summarize what has been officially confirmed, what is still unknown and, above all, what small and medium-sized businesses (SMBs) in Japan can do right now to avoid the same scenario with their own vendors. All information comes from Daiichikosho's official notice and from the press outlets listed at the end.

What happened, according to the official notice

The timeline published by Daiichikosho, based on NCG's report, is as follows:

• October 1–2, 2026: a malware infection was found on a PC used by an NCG employee.
• October 2: the device was isolated from the network.
• October 5: after investigating the scope of the impact, NCG notified Daiichikosho.
• October 8: Daiichikosho published its notice to customers.

NCG is the company to which Daiichikosho outsources part of its personal data handling. The infected PC was temporarily storing personal data related to that outsourced work. According to the notice, NCG has already reset passwords and other authentication credentials and is still investigating the cause, the extent of the damage and whether data actually leaked.

Important: as of this writing, the company says it has not confirmed that the data actually left the company or that it has been misused. What exists is the possibility of a leak (漏えいのおそれ), which cannot be ruled out. BleepingComputer reported that it could not find a public statement from NCG itself and that it has asked the company for comment.

What data and who may be affected

The data that may have leaked belongs to people who registered as members or made reservations at the group's stores:

• name (or registered name);
• gender;
• date of birth;
• email address;
• phone number.

These are the figures released by Daiichikosho:

According to the company, passwords are not among the data, and this information alone cannot be used to spend customers' loyalty points (DK Points). So far, no misuse of points has been confirmed either.

The real risk: targeted phishing

Name, date of birth, email and phone number look like "harmless" data, but they are exactly what a scammer needs to build convincing messages. Daiichikosho itself warns that, if a leak occurred, the data could be used in spoofed emails and phishing scams, and asks customers to be careful with suspicious emails, SMS and phone calls and not to open unfamiliar links or attachments. The company also states that it never asks for passwords or credit card information.

If you or your employees use Big Echo or other brands in the group, it is worth reinforcing the following internally over the coming months:

1. Be suspicious of "personalized" messages that mention your name and date of birth and talk about karaoke, points or reservations.
2. Do not click SMS links about "account problems" or "expiring points". Go to the official website or app by typing the address yourself.
3. Turn on two-factor authentication for important services, because leaked emails and phone numbers make social engineering easier.
4. Use the official support channel listed by Daiichikosho in its notice if you have questions.

The main lesson for businesses: vendor risk

For anyone running IT, the most instructive part of this case is the supply chain. Daiichikosho says its systems were not affected, yet it still has to deal with the possible exposure of more than 8.7 million records. This happens because responsibility for the data stays with the data owner, even when processing is outsourced.

Under Japan's Act on the Protection of Personal Information (APPI), as explained by the Personal Information Protection Commission (PPC):

• Reporting to the PPC is mandatory for leaks, or the possibility of a leak, involving more than 1,000 people, sensitive data, a risk of financial damage or suspected wrongful intent, such as unauthorized access.
• The report is made in two stages: a preliminary report "promptly", which the PPC says is generally within 3 to 5 days, and a final report within 30 days, or 60 days in cases of suspected wrongful intent.
• When the leak occurs at a vendor, in principle both the entrusting company and the vendor are obliged to report. The vendor can be exempted if it notifies the entrusting company, but the entrusting company's obligation remains.
• The entrusting company also has a duty to properly supervise the vendors to which it entrusts personal data.

Daiichikosho said it will review how it manages its contractors and strengthen the necessary measures. This is a good time to carry out the same review in your own company.

A practical checklist for Japanese SMBs

Based on this case, these are the measures we recommend to our clients:

1. Map who holds your data. List the vendors that receive customer or employee data: accounting, payroll, marketing, system development, call centers.
2. Ban personal data on local PCs. If the vendor needs to process data, it should happen in a controlled environment, such as cloud storage with access control and logs, not in spreadsheets saved on an employee's laptop.
3. Send only what is necessary. If the vendor only needs email addresses, do not send dates of birth. Less data means less impact.
4. Set deletion deadlines. "Temporary" data needs a date by which it is deleted, and that deletion should be verifiable.
5. Put incident notification in the contract. Require notification within a short deadline, because your clock for reporting to the PPC starts when you learn about the incident.
6. Require basic protection on devices: EDR or managed antivirus, automatic updates, disk encryption and two-factor authentication.
7. Have a response plan ready: who decides, who talks to the PPC, who handles customers and what the notice template looks like.

None of these measures require big budgets. Most of them are process and contract, and that is exactly what tends to be missing when an incident happens.

Conclusion

The Daiichikosho/NCG case shows that a single PC at a single vendor can put millions of records at risk. It has not yet been confirmed that the data leaked, and the investigation continues. But the lesson is already clear: protecting your own servers is not enough if data flows without control through your vendor chain. For Japanese SMBs, reviewing contracts, reducing the data you share and requiring minimum controls on partners' devices are cheap steps that greatly reduce risk.

We will update this article if Daiichikosho or NCG release new facts.

Sources

• Daiichikosho: 委託先における個人情報漏えいのおそれについて (official notice, Oct 8, 2026)
• Daiichikosho: Notice Regarding the Potential Leakage of Personal Information at a Contractor (English version)
• BleepingComputer: Nippon Columbia malware incident exposes 8.6 million karaoke fan records
• INTERNET Watch: 第一興商、委託先への不正アクセスで「ビッグエコー」などの利用者情報約872万件が漏えいのおそれ
• ビジネス+IT: 第一興商、委託先PCのマルウェア感染 ビッグエコーなど約872万件に漏えいのおそれ
• 個人情報保護委員会 (PPC): 漏えい等の対応とお役立ち資料
• PPC: 委託先において個人データが漏えいしてしまった場合の対応
• PPC/MHLW: 漏えい等報告の義務化と対応について (PDF)

---

Want this for your business?

KGA IT helps small and medium-sized businesses set up AI assistants, automation and websites. The consultation is free and we reply within 24 hours. Plans start at ¥5,000/month.

• Phone: 080-9732-1062
• Email: kga-it@outlook.com
• Contact page: kga-it.com/en/contact