Bandai Namco data breach affects over 300,000 users (Image via Bandai Namco)
Bandai Namco says the breach exposed the data of roughly 346,000 members of The GUNDAM base, its Gundam-focused membership service. The company announced the incident on October 28, 2026. Japanese broadcaster NHK reports that YmirLink first disclosed about 9 million leaked records on October 19. Further investigation raised the total to more than 51.62 million records.
Bandai Namco, the publisher behind Tekken and a long list of other popular games, has confirmed a data breach that exposed customer information. Japanese railway operators JR Central, JR West, and JR Kyushu have also reported possible leaks. The company has taken several steps: Suspended the affected email distribution service Reported the breach to Japan’s Personal Information Protection Commission Begun investigating alongside YmirLink to determine the full impact Join conversation Share your thoughts in the comments Be respectful · TOI community guidelines Bandai Namco says it hasn’t confirmed any secondary damage, such as misuse of personal information, as of its announcement.
The leaked information includes only: Email addresses Internal Bandai Namco ID numbers The company says the following were not leaked: Passwords Credit card details Names Addresses Purchase history This sets the incident apart from Sony’s recent So-net and plala breach, where names, phone numbers, and some bank account records were exposed, according to Bandai Namco. The company wasn’t hacked directly, and the problem came from a third-party email service provider called YmirLink. YmirLink’s systems were compromised in a much larger leak, resulting in Bandai Namco’s details also being leaked. In the section below, we take a detailed look at the Bandai Namco data breach. The notice has since been taken down from its site. The root cause lies with YmirLink, which handles email distribution for multiple organizations. Bandai Namco is one of several customers affected, so the incident is an example of supply-chain risk: a breach at a vendor spreads to every company relying on it. The exposure is limited, which is the good news. The Bandai Namco numbers are a small piece of a much bigger problem. The data is mostly email addresses, and it affects other organizations that use YmirLink. Even without passwords or payment details, exposed email addresses carry risk. Attackers can use them for phishing or impersonation, particularly if they can pair the address with an internal ID that looks official. Bandai Namco has warned affected users to be careful with suspicious messages. It added that any emails it sends about the incident will not contain URLs in the body, so a message about this breach that includes a link should be treated as a red flag. Don’t click links in unexpected emails claiming to come from Bandai Namco or The GUNDAM base. Check the sender address closely before opening anything. If you reuse a password across accounts, change it as a precaution, although passwords weren’t part of this leak. Consider using a unique email alias for gaming accounts. The investigation is ongoing, so the count could still change. For now, the practical advice is simple: stay alert and don’t trust links in unsolicited emails. Get the latest Sports News and Live updates. Download the TOI app.
The breach also follows Capcom’s disclosure last week and Sony’s earlier this week, which makes for a rough stretch for the gaming industry’s data security.