Bandai Namco has disclosed a data breach affecting 346,247 records belonging to members of THE GUNDAM BASE MEMBERS, a membership service associated with its Gundam-related facilities in Japan. The exposed information includes users’ email addresses and internal identifiers used to manage their Bandai Namco IDs.
Bandai Namco Entertainment and BANDAI SPIRITS announced the incident after receiving a report of unauthorized access to Ymir Link, the company entrusted with operating the email service used by Bandai Namco ID. The incident was publicly disclosed on October 27, 2026, with further reporting emerging on October 28.
According to the companies, the leaked information does not include login passwords, credit card details, names, addresses, or purchase histories. However, affected users could face an increased risk of phishing attempts and fraudulent emails targeting their accounts.
Bandai Namco Confirms Data Breach Affecting Over 346,000 Records
The incident involves THE GUNDAM BASE MEMBERS, a membership service operated by BANDAI SPIRITS that uses Bandai Namco ID’s email service.
On October 26, Ymir Link reported signs of unauthorized access to the system environment used for the membership service, along with evidence that information had been obtained. Bandai Namco subsequently confirmed that members’ email addresses had been exposed.
The company identified 346,247 affected records, containing email addresses and internal identifiers used to manage Bandai Namco IDs.
Although the incident involves a Bandai Namco service, the unauthorized access occurred at its outsourced email service provider, Ymir Link. The companies are continuing to investigate the incident, including its potential impact on other environments managed by the provider.
What Information Was Leaked in the Bandai Namco Data Breach?
Bandai Namco clarified that the breach exposed a limited set of information associated with THE GUNDAM BASE MEMBERS.
The exposed information includes:
- Registered email addresses.
- Internal identifiers used for Bandai Namco ID management.
The companies stated that the breach did not involve login passwords, credit card information, names, addresses, purchase histories, or other information registered with Bandai Namco ID and THE GUNDAM BASE MEMBERS.
Bandai Namco has also stated that it has not confirmed any secondary misuse of personal information resulting from this incident at the time of its announcement.
However, the exposure of email addresses can still present a security risk. Attackers could use the information to send convincing fraudulent messages impersonating Bandai Namco or other legitimate organizations.
Bandai Namco Suspends Affected Email Service
Following the discovery, Bandai Namco immediately suspended the email distribution service used by THE GUNDAM BASE MEMBERS.
The company also reported the incident to Japan’s Personal Information Protection Commission and is working with Ymir Link to investigate the cause, establish the full scope of the breach, and implement measures to prevent similar incidents.
Bandai Namco ID and THE GUNDAM BASE MEMBERS services remain available for users. The company said it would contact affected members directly where possible.
Further investigation is also underway to determine whether other environments using Ymir Link’s services were affected by the unauthorized access.
Gundam Base Members Warned About Potential Phishing Attacks
Bandai Namco has warned affected users to remain cautious about suspicious emails, particularly messages that attempt to impersonate the company or trick recipients into revealing personal information.
The company specifically warned that exposed email addresses could be exploited for phishing scams and other forms of unsolicited communication.
To help users identify legitimate communications, Bandai Namco stated that emails it sends regarding this incident will not include URLs in their message bodies. Members should be particularly cautious of unexpected links requesting account information or other personal details.
Although the company has not confirmed secondary misuse arising from this particular breach, the possibility of fraudulent messages makes vigilance important.
The incident also highlights the security risks associated with third-party service providers. Even when a company’s primary membership systems are not directly compromised, unauthorized access to an outsourced service can expose information belonging to its customers.
Bandai Namco and Ymir Link are continuing their investigation, with further updates expected if additional information comes to light.
Bookmark Otaku Mantra for more gaming, anime, and industry news.
Source: News JP
