Malware breach at Nippon Columbia leaks over 8.6 million karaoke user and staff records

Daiichi Kosho, a leading Japanese manufacturer of karaoke equipment, announced that a malicious software infection at its subcontractor Nippon Columbia has resulted in the exposure of more than 8.7 million personal records belonging to both customers and employees.

The compromised data set includes names, contact details, purchase histories and, in some cases, employment information. While the exact nature of the malware has not been disclosed, the breach appears to have stemmed from a vulnerability in the contractor’s network that allowed unauthorized access to the database used for managing karaoke system subscriptions and staff payroll.

Japanese privacy regulations, including the Act on the Protection of Personal Information, require companies to report data breaches that could affect a significant number of individuals. Daiichi Kosho’s disclosure follows the mandated timeline, and the firm has pledged to cooperate with authorities to determine the breach’s scope and to mitigate any potential harm to affected parties.

Industry analysts note that the incident underscores a broader risk in Japan’s entertainment sector, where legacy hardware and software often operate alongside newer, cloud‑based services. The integration of third‑party vendors can create attack surfaces that are difficult to monitor, especially when older systems lack robust security patches.

Consumer advocacy groups have called for clearer guidelines on how companies handle personal data tied to entertainment services, arguing that users may not realize how much information is collected through karaoke machines that track song selections, usage frequency and payment details. The breach may prompt a reassessment of data‑handling practices across the industry.

Going forward, Daiichi Kosho said it is conducting a comprehensive security audit of all its external partners and will implement additional encryption and monitoring tools. Nippon Columbia has reportedly begun its own investigation and is working with cybersecurity firms to remove the malicious code. Affected individuals have been notified and advised to watch for phishing attempts that could exploit the leaked information.