You signed up for a karaoke membership at Big Echo years ago. Last week a caller read back your name, your birthday and your phone number. Then they asked you to confirm a payment detail. Nothing felt wrong, because the caller knew too much to be a stranger. That readback is what the Nippon Columbia data breach actually produced, and it reached 8.63 million people.
Confirmation: confirmed by Daiichikosho, the karaoke operator, in a notice published on October 8. The company says it has not confirmed any actual leak of the data, or any misuse of it.
What happened in the Nippon Columbia data breach
Daiichikosho runs Big Echo, a chain of 521 karaoke venues in Japan. It does not hold all of its own customer records. Nippon Columbia Group, a contractor in Tokyo, keeps that data on its behalf.
On October 1 and 2, malware turned up on one Nippon Columbia employee’s computer. That single machine could reach Daiichikosho’s customer database. The contractor pulled the terminal off its network and reset its credentials.
Daiichikosho was told on October 5. It published a customer notice on October 8, then an update on October 9 that added nothing material. The company says its own systems came through untouched, and that the contractor’s investigation continues.
So the chain here is worth naming plainly. One infected laptop at a vendor put a karaoke chain’s whole membership list at risk, and the karaoke chain itself was not breached.
What the Nippon Columbia data breach exposed
The figures Daiichikosho published fall into two groups. About 8,631,000 customer records are at risk, plus about 93,000 employee records — roughly 8.72 million in total.
For customers, the fields are name or registered name, gender, date of birth, email address and phone number. Passwords were not in the data set, because the contractor did not hold them. Daiichikosho also says it has found no fraudulent use of loyalty points.
Members of several brands may be affected, not just Big Echo. The notice names MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining.
One figure is unsettled, so it is worth flagging. English coverage has run the customer count as 8.6 million and the total as 8.7 million, while the Japanese wire reports give 8,724,000 across both groups. Both describe the same disclosure.
Why a birthday and a phone number are enough
A leak with no passwords in it sounds survivable, and in one sense it is. Nobody logs in to an account with a date of birth. But that is not what this data is for.
Date of birth and phone number are the two things a call center asks to verify you. So an attacker holding both can pass as you to a third party. Meanwhile they can also pass as the karaoke chain to you, because they know which brand you joined.
Daiichikosho has said it does not ask customers for passwords or card details by email. That sentence is the test to apply to anything arriving in its name.
The email address is the delivery route for all of it. For example, a message citing your name and your membership brand reads as routine, and routine is what gets clicked.
What to do now
Most of what helps here has nothing to do with us.
- Treat a readback of your details as worthless. A caller who knows your birthday has proved they hold the leaked file, not that they work for anyone.
- Expect a follow-up message dressed as Big Echo or DAM. Reach the company by typing its address yourself rather than tapping a link.
- Change any password you reused elsewhere, if the karaoke signup shared one. A password manager turns that into a one-time job.
- Turn on the strongest sign-in your email account offers, which means a passkey or an authenticator app rather than SMS codes.
- Watch Have I Been Pwned for this breach, then switch on its notifications so you hear about the next one.
In short, the data is out, so the thing to defend is the next message.
How OptMsg changes this exposure
We should be careful here. This breach happened at a contractor in Tokyo, and nothing on our side would have changed that.
What changes is the size of the aftermath in your inbox. Your OptMsg account has no password, so a password stolen from another site can’t open your inbox — there is no password on it to match. And because an email inbox is the reset route into most of your other accounts, an inbox that resists a stolen credential keeps that credential away from the rest.
Separately, mail from a sender you have not approved goes to Trash rather than your Inbox, and auto-deletes after 30 days. The phish built from this leak lands there.
Here is what the argument does not cover, stated plainly. It does nothing about a compromised device, a live phishing page you type your details into, or somebody holding your unlocked phone. Our simple by design page lays out how we think about keeping an inbox quiet.
Want an address that a leaked password cannot open? Create your OptMsg account and pick your name while it is still free to choose.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Q: Was my password exposed in the Nippon Columbia data breach? A: No. The contractor did not hold passwords for karaoke memberships, so there were none in the data. If you reused a password from that signup somewhere else, though, change it there.
Q: Which karaoke brands are affected? A: Daiichikosho names Big Echo, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining. Employee records are also in scope, about 93,000 of them.
Q: Has my data actually leaked, or might it have? A: Daiichikosho says it has not confirmed any external leak or any misuse. The 8.72 million figure describes records the contractor’s infected machine could reach, so treat it as exposure rather than proof of theft.
Q: Why does an email address matter if nothing else was taken? A: Because it is where the follow-up arrives. Somebody holding your name, your birthday and the brand you joined can write a message that reads like a routine notice, and that message is now the attack.
Q: Was Daiichikosho itself hacked? A: The company says its own systems were not affected. The malware was found on one employee computer at Nippon Columbia Group, the contractor that handles the customer data.
Sources
- BleepingComputer, “Nippon Columbia malware incident exposes 8.6 million karaoke fan records,” October 11, 2026 — https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/
- Nikkei, “「ビッグエコー」の第一興商、個人情報872万件漏洩の恐れ,” October 8, 2026 — https://www.nikkei.com/article/DGXZQOUC088GB0Y6A001C2000000/
- Impress Internet Watch, report on the Daiichikosho contractor malware disclosure, October 2026 — https://internet.watch.impress.co.jp/docs/news/2147032.html
- SB Creative BIT, Daiichikosho disclosure detail and customer guidance — https://www.sbbit.jp/article/cont1/187367
- Jiji Press via nippon.com, “More Japanese Firms Hit by Large-Scale Data Breaches,” October 9, 2026 — https://www.nippon.com/en/news/yjj2026100900441/more-japanese-firms-hit-by-large-scale-data-breaches.html
Previous in Breach Breakdown: The Double Counter Breach Put a Stranger's Invite in 50 Discord Servers
Next in Breach Breakdown: The iRhythm Data Breach Handed Strangers Your Heart Monitor’s Paper Trail
