Nippon Columbia malware incident exposes 8.7 million karaoke customer records

Daiichi Kosho, a major Japanese entertainment system maker and the country's largest karaoke operator, disclosed that a malware infection at its contractor Nippon Columbia exposed more than 8.7 million records. The exposed data contains details on 8,631,000 customers and 93,000 employees, tied to personal information handling that Daiichi Kosho outsources to Nippon Columbia Group. Daiichi Kosho said it has not confirmed any data theft or leak, but is urging customers to stay cautious because of the potential risk.

According to the disclosure, Nippon Columbia Group told Daiichi Kosho on October 5 that malware had been found on an employee's computer, and the affected system was isolated the following day. Daiichi Kosho said its own systems were not breached. The contractor has since reset passwords and other authentication credentials, and is investigating what caused the incident, how far it spread, and whether any data has surfaced online.

Daiichi Kosho operates 521 karaoke venues across Japan, including the Big Echo chain, one of the country's most popular karaoke box brands. Nippon Columbia Group is an entertainment company whose operations span music, video and game software production and distribution as well as artist management. The incident may affect customers of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining.

The company said the exposed records do not include passwords, and that it has found no evidence of unauthorized use of loyalty points. An update issued Friday did not add information about whether a data leak had occurred. Daiichi Kosho is advising customers to treat unsolicited messages by email, SMS or phone that ask for payments or sensitive personal or financial details with suspicion.

BleepingComputer reported that it could not find a public announcement from Nippon Columbia Group about the security incident, and said it has contacted the firm while awaiting a statement. Daiichi Kosho has not indicated when the investigation might conclude or whether it will issue further updates.