Bandai Namco Entertainment and its group company BANDAI SPIRITS said on the evening of October 27, 2026 that an attacker broke into Ymirlink Inc., the Tokyo contractor that sends email for the Bandai Namco ID account service. The attacker took customer data belonging to members of THE GUNDAM BASE MEMBERS, a points program run by BANDAI SPIRITS. Reported totals range from "about 340,000" in Kyodo News's headline to roughly 346,000 in Kyodo's article body and BigGo Finance. Gaming outlet 4Gamer, citing the companies' notice, gives the exact figure: 346,247 records. The leaked data is email addresses and an internal identifier. The companies say passwords and credit card details were not included. This is the third known exposure of Bandai Namco group customer data in October. Separately, the group is still investigating a break-in at its logistics subsidiary, Bandai Logipal, that may have exposed names, home addresses and phone numbers of Ichiban Kuji ONLINE customers.
What Happened
According to the companies' statement as reported by 4Gamer and BigGo Finance, Ymirlink (also written "Yumir Link") told Bandai Namco about the unauthorized access on October 26. The companies announced it the next evening. THE GUNDAM BASE MEMBERS used the Bandai Namco ID mail service, and that environment is where the data leaked from.
What the companies have done so far:
- Suspended the affected mail service. Kyodo reports this happened as soon as the access was discovered. The Bandai Namco ID and Gundam Base Members services themselves are still running, 4Gamer says.
- Reported the incident to Japan's Personal Information Protection Commission. This is according to 4Gamer. The commission has not published anything about it.
- Kept investigating, including other Ymirlink setups. The companies say they are still checking whether other environments they run through Ymirlink were affected. This matters: the 346,247 figure may not be final, and other Ymirlink clients could be exposed too. Ymirlink has not published its own account of the breach.
The companies say they have not seen the data misused so far.
This is separate from the Bandai Logipal incident. On October 26, Bandai Namco Holdings disclosed that a third party had accessed a system run by its logistics subsidiary, Bandai Logipal. Game News Tokyo reports the access was found on October 21. 4Gamer and ITD report that delivery details for Ichiban Kuji ONLINE, a BANDAI SPIRITS lottery-prize store that uses Logipal for shipping, may have leaked: recipient names, addresses and phone numbers. The number of people affected is still under investigation. Logipal's shipping system has been offline since October 26 for a full check. Akiba Brief describes the two incidents as unrelated, and no company statement links them.
An earlier vendor breach also hit the group. Earlier in October, Bandai Namco Experience confirmed that about 1,700 members of its arcade portal were caught up in the breach at community-platform vendor Commune. That figure comes from AliasFleet, an email-alias service whose operator has been tracking the Commune disclosures. AliasFleet puts the total Commune exposure at about 307,000 member records, roughly 126,000 of them with email addresses.
What Was Taken
The companies' notice, as quoted by 4Gamer, lists two types of data for 346,247 Gundam Base Members registrants:
- Email addresses
- Internal identifiers used to manage Bandai Namco ID accounts
The companies say login passwords and credit card details were not included. Kyodo adds that names and postal addresses were not compromised.
On its face, this is a low-sensitivity leak: no passwords, no payment data. But it is a clean list of confirmed, active addresses belonging to people who collect Gundam merchandise and earn and redeem points for it. That makes very believable bait for phishing. Possible lures include "points expiring," "redeem your reward" or "account verification" emails that pretend to come from Bandai Namco or The Gundam Base. Bandai Namco has said that any email it sends about this incident will contain no URLs. Customers can use that as a simple test: a message about this breach that includes a link is not from the company.
The internal identifier is less obviously useful to an attacker. Bandai Namco has not said whether it can be used for anything outside its own systems. Pairing it with email addresses does let an attacker show they hold "real" account data in a scam message.
The Logipal data, if confirmed, is more sensitive. Names, home addresses and phone numbers allow scams by phone and post, not just email. ITD advises affected Ichiban Kuji ONLINE customers not to call numbers or scan QR codes printed on unexpected letters.
Why It Matters
Email delivery providers hold large customer lists. Brands hand their full customer mailing lists to email service providers so those providers can send newsletters, password resets and transactional messages. One breach at the provider exposes the customer base of a brand that was never itself breached. Bandai Namco's note that it is checking "other environments contracted to Ymirlink" suggests the company itself isn't sure how far the exposure goes.
The group's exposure keeps coming through third parties. In under a month, three separate Bandai Namco group customer populations have been exposed: arcade portal members through Commune, Gundam Base members through Ymirlink, and Ichiban Kuji ONLINE customers through Bandai Logipal. Two of these were outside vendors, and the third was the group's own logistics subsidiary. None was the core game platform. For defenders, the lesson is that your customer data's attack surface is as wide as the list of everyone who processes it.
It is part of a wider run of attacks on Japanese companies. The same week, Good Smile Company disclosed that its online store's admin system was accessed between October 19 and 22, exposing member details and partial card data (Akiba Brief). On October 24, Kyodo reported that Japan's National Institute of Information and Communications Technology (NICT) believes weaknesses in Android apps are behind a series of recent breaches at Japanese firms, with AI being used to attack the servers behind them. Nobody has linked the Ymirlink or Logipal breaches to the NICT findings, and nothing published so far ties these incidents to a single actor.
The Attack Technique
Not disclosed. Neither Bandai Namco nor BANDAI SPIRITS has said how the attacker got into Ymirlink. Ymirlink has not published a technical account, and no group has claimed the attack. It is not known whether this was stolen credentials, an exploited flaw in the mail platform, or abuse of an API or admin interface.
The same applies to Bandai Logipal. The group says a third party accessed a system the subsidiary manages and gives no method. The Game News Tokyo summary is ambiguous about whether October 21 was the date of the access or the date it was found. The Japanese-language reports describe October 21 as the discovery date.
What the details do show:
- The attacker reached customer mailing data, not Bandai Namco's account database. The leaked fields are exactly what an email platform needs to send messages: an address and a customer key. Password data was absent, which fits that picture.
- Bandai Namco learned about it from the vendor. The company was told on October 26. That means its own monitoring depended on Ymirlink detecting the access and reporting it.
- Exposure was limited to what was shared. Kyodo says names and addresses were not exposed, which suggests Bandai Namco shared only the fields needed to send mail. That limited the damage.
What Organizations Should Do
- List every outside provider that holds your customer contact lists. Include email service providers, CRM tools, community platforms and logistics partners. For each one, record which fields you share and how many records they hold. You can't size a vendor breach in hours if you don't know what the vendor has.
- Share as little data as each provider needs. Bandai Namco's mail contractor apparently held only email addresses and an internal key, which kept names, addresses and payment data out of the leak. Apply the same rule everywhere. Don't sync full profiles to a provider that only sends email.
- Plant tracking addresses in every vendor list. Add unique, monitored email addresses (one per vendor) to each list you share. If one of them starts receiving phishing, you know which vendor leaked before that vendor tells you.
- Write vendor contracts that set breach-notice deadlines and require clear scope. Require notice within a fixed number of hours and a statement of which client environments were affected. Ymirlink's other clients currently have no public guidance about whether their data was taken.
- Decide your breach-communication rules in advance. Bandai Namco's promise of no links in incident emails is a good model. Announce a simple, checkable rule ("we will never include a link or ask for a password in these emails") at the moment of disclosure, before phishing campaigns start.
- Check the security of your mobile apps and the servers behind them. Given NICT's warning about Android app weaknesses being used against Japanese firms, look for hardcoded credentials, exposed API endpoints and weak backend login in your apps and in your vendors' apps.
Sources: Entertainment firm Bandai Namco says about 340,000 personal records... | Ichiban Kuji ONLINE Data Breach (October 2026): Bandai Logipal Unau... | Commune Breach Grows: Sansan, Panasonic Disclose Email Leaks | Good Smile and Bandai Namco Report Possible Data Leaks | Bandai Namco Says 346,000 Customer Email Addresses Leaked After Una... | 「バンダイナムコID」の委託先で不正アクセス。「THE GUNDAM BASE MEMBERS」，メールアドレス34万件超が漏えい | Bandai Namco Holdings discovers unauthorized access to systems mana... | Vulnerability in apps behind recent spate of cyberattacks ...