Saturday, 31 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Original editorial illustration of a dark model-kit workshop shelf at night: rows of unbuilt mecha model boxes receding into shadow, one open box glowing warm amber from within, with small blank paper envelopes drifting from it across the shelf toward the viewer

Bandai Namco Breach: 346,247 Gundam Base Emails Leaked

by

Bandai Namco Breach: 346,247 Gundam Base Emails Leaked

In brief

  • Bandai Namco confirmed 346,247 Gundam Base emails leaked through email vendor YmirLink. What was taken, what was not, and how to spot the phishing that follows.
  • Bandai Namco Entertainment and BANDAI SPIRITS said on October 27, 2026, that 346,247 email addresses registered with THE GUNDAM BASE MEMBERS, plus internal Bandai Namco ID identifiers, had leaked after unauthorized access at YmirLink, the contractor that runs the service’s email distribution.
  • What was NOT taken matters here: no names, addresses, login passwords, credit card details, or purchase histories, according to the companies — but an email address paired with a known membership is exactly what a convincing phishing email is built from.
  • The Bandai figure is only one slice of a much larger vendor incident: YmirLink’s own October 26 report puts its cumulative leak at 51,628,280 records across 49 of its email systems, with 16 more systems still being counted.

Last verified: October 29, 2026.

What happened

Bandai Namco Entertainment and BANDAI SPIRITS announced on October 27, 2026, that customer information belonging to members of THE GUNDAM BASE MEMBERS had leaked. THE GUNDAM BASE MEMBERS is the free membership service tied to Bandai’s official Gunpla model-kit stores — members earn points from eligible purchases and exchange them for exclusive rewards, across The Gundam Base Tokyo and Fukuoka, satellite stores, and the online shops.

The timeline the companies gave is short and specific. On October 26, YmirLink — the Japanese provider contracted to operate the email service used by Bandai Namco ID — reported signs of unauthorized access to the system environment used for the membership service, along with evidence that information had been obtained. Bandai confirmed the next day that members’ email addresses had been exposed, reported the incident to Japan’s Personal Information Protection Commission, and suspended the affected email distribution service. Bandai Namco ID itself and THE GUNDAM BASE MEMBERS remain available to users; only the email distribution channel was stopped.

That sequence — a contractor’s system, not the brand’s own — is the pattern to notice, because it is the same pattern behind several of October’s other breaches. The company whose name is on the membership did not have its own systems broken into, as far as the disclosure says. The system that was accessed belongs to the vendor that sends its emails. Customers handed their address to Bandai; it was YmirLink’s environment that leaked it. That distinction does not make the leak less real for the 346,247 people involved, but it does change where the fix has to happen — and it means Bandai is unlikely to be the last brand to announce an incident from this same vendor breach.

What was exposed — and what was not

The companies identified 346,247 affected records, each containing an email address and an internal identifier used to manage a Bandai Namco ID. That pairing is worth pausing on: the identifier alone is an internal reference, not a password or a login credential, and the companies stressed what the leak did not include — members’ names, addresses, purchase histories, login passwords, and credit card details were not among the exposed data.

Read that list honestly, in both directions. On one side, this is not a credential breach: nobody’s account can be logged into with what was taken, and no payment information changed hands. On the other side, an email address that is known to belong to a Gundam Base member is a far better phishing lure than a random address. A message that arrives at the right inbox, addressed to a real member of a real service, claiming to be about that service, does not need a name or a password to work — it needs to be believed for one click. Bandai’s own warning points the same way: the companies said their emails about the incident will contain no URLs, and asked members not to open links or enter details in suspicious messages. That no-URL rule is the single most useful tell in this story. Any message about this breach that asks you to click a link is, by Bandai’s own account, not from Bandai.

At the time of the announcement, the companies said no secondary damage — such as unauthorized use of the leaked information — had been confirmed. Members who can still be reached will be contacted individually; former members who can no longer be reached directly will have to rely on the public announcement and subsequent updates.

The bigger number behind the headline

The 346,247 figure is Bandai’s slice. YmirLink’s own incident reporting tells a much larger story, and it is the reason this breach deserves attention beyond one fan club.

YmirLink first disclosed the incident on October 19, 2026, covering five of its Cuenote FC email systems and estimating about 9 million cumulative records containing email addresses had been extracted. Its second report, issued on October 26, widened the picture sharply: unauthorized access across 81 Cuenote FC systems, confirmed data leakage from 49 of them, and a cumulative total of 51,628,280 records. Sixteen of those systems were still under investigation when the second report was published, so the total may still grow. YmirLink has also said that contract customer information in its Cuenote BASE customer-management system was viewable, affecting 190 records, and that it has notified the Tokyo Metropolitan Police Department and reported the leak to the Personal Information Protection Commission.

Other YmirLink clients are already surfacing. Reporting on the wider incident notes that members of the Smart EX Shinkansen booking service had their emails and IDs exposed through the same vendor breach. YmirLink does not name its client companies in its own reports, so further brand announcements may follow as each client completes its own checks — exactly the staggered pattern Bandai’s October 27 announcement fits, a week after YmirLink’s first report.

YmirLink has also warned of a second-order risk: spam sent from its own domain under third-party names, including messages from its Cuenote address using a Saison card name. As of its October 26 update, the company said it had not confirmed that leaked personal data had been made public or misused. That is a narrower claim than it sounds — “not confirmed misused” is not the same as “not misused” — and it sits alongside the phishing risk that Bandai itself flagged.

Why an “email-only” leak still matters

It is tempting to file this one under “minor” because no passwords or payment details were involved. Three reasons argue against that.

First, email addresses are the raw material of targeted phishing, and this leak hands attackers a pre-filtered list: people known to be interested in Gundam and Gunpla, reachable at addresses they actually check. A fake “your Gundam Base points are expiring” or “confirm your membership” message lands very differently on that list than on a random spam run.

Second, the vendor pattern means the exposure is not contained to one brand’s judgement. A member did not choose YmirLink, did not sign up with YmirLink, and probably had never heard of YmirLink before this week. Their data travelled to a contractor they never dealt with, through a contract they never saw. That is how most modern breaches work now — the breach happens one step removed from the brand on the letterhead — and it is why “we were not hacked, our vendor was” is a distinction without much comfort for the people whose addresses leaked.

Third, the count is still moving. YmirLink’s total grew from about 9 million to 51.6 million in a week, with 16 systems uncounted. Bandai’s figure is confirmed for one service; whether other services using the same email environment produce further announcements is an open question, not a closed one.

The comparison with the previous week’s gaming breach is instructive. Capcom’s announcement covered 11.7 million accounts — a far larger direct figure — but the mechanism there, too, involved a contractor-adjacent exposure, and the advice to affected users was the same: watch for impersonation. The scale differs; the playbook for attackers does not.

What this means for you

  • If you are a THE GUNDAM BASE MEMBERS member, expect Bandai’s individual contact if you can still be reached — and apply the no-URL test to anything claiming to be about this breach. A genuine Bandai notice about this incident will not contain links. A message with a link, asking you to confirm details or claim points, should be treated as phishing.
  • Do not click through from an email about this breach to “check your account.” Go to the Bandai Namco ID or Gundam Base site directly, by typing the address yourself, if you want to check anything.
  • Watch for phishing that uses the membership itself as its hook: points expiring, exclusive rewards, membership renewal, or a fake data-protection notice. The leaked data makes those lures plausible; plausibility is the attack.
  • Your Bandai Namco ID password was not listed among the exposed data, and there is no reason to change it because of this leak alone. If you reuse that password anywhere else, that reuse — not this breach — is the reason to change it.
  • If you use the same email address for other services, remember it is now on a list circulating from the YmirLink incident, not just the Bandai slice. The same caution applies to messages impersonating other brands whose email systems ran through the same vendor, including services you may not associate with this story yet.
  • Keep an eye on further YmirLink client announcements. If another service you use discloses an incident traced to the same vendor, treat it as part of this incident, not a coincidence.

What to watch next

Three questions will decide how this incident ends. First, growth: whether YmirLink’s cumulative total rises further once the 16 outstanding systems are counted, and whether new client brands announce their own slices. Second, misuse: whether the phishing Bandai warned about materializes at scale, or whether the leak stays, as YmirLink put it, unconfirmed as misused. Third, accountability: what Japan’s Personal Information Protection Commission and the Tokyo police investigation establish about how the vendor’s systems were accessed, and whether other clients’ data was exposed through the same route.

For now, the confirmed facts are these: one vendor, 51.6 million records and counting; one brand’s slice, 346,247 Gundam Base member emails plus internal identifiers; no passwords, names, addresses, or payment data in the Bandai slice; no confirmed secondary damage at announcement; and a no-URL rule that is, for once, a genuinely useful way to tell the real notice from the fake one. That is serious enough on its own. It does not need borrowed scope from the wider YmirLink total — or borrowed reassurance from the “email-only” label — to matter.

Related reading

Sources

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment