Bandai Issues Warning After Major Gundam Base Data Leak Affects More Than 346,000 Members
Image by Charlotte Davis
Bandai Namco Entertainment and BANDAI SPIRITS have issued warnings to more than 346,000 Gundam Base members after customer information was exposed through a cyberattack on an external service provider.
The incident affected “THE GUNDAM BASE MEMBERS,” with 346,247 registered email addresses and their associated internal Bandai Namco ID identifiers confirmed to have leaked following unauthorized access to contractor Ymir Link.
THE GUNDAM BASE MEMBERS is the free membership service connected to Bandai’s official Gunpla retail network, allowing registered users to earn Gunpla Points from eligible purchases and exchange them for exclusive rewards.
The service is used across locations including The Gundam Base Tokyo and Fukuoka, Gundam Base Satellite stores and GUNDAM SIDE-F, with eligible purchases through Premium Bandai’s Hobby Online Shop and The Gundam Base Online Shop also contributing points.
Bandai has stressed that the leaked information did not include members’ names, addresses, purchase histories, login passwords, or credit card details.
Ymir Link notified Bandai Namco Entertainment on October 26 after identifying signs of unauthorized access and data acquisition within the environment used to provide email services for THE GUNDAM BASE MEMBERS.
Bandai Namco Entertainment and BANDAI SPIRITS announced the leak the following day and reported the incident to Japan’s Personal Information Protection Commission as they began investigating its cause and full impact alongside Ymir Link.
The affected Gundam Base email distribution service was immediately suspended, but Bandai says Bandai Namco ID and THE GUNDAM BASE MEMBERS themselves remain available for users.
People whose information was affected will be contacted individually where possible, while former members who can no longer be reached directly will instead need to rely on the public announcement and any subsequent updates.
No secondary misuse of the leaked information had been identified at the time of Bandai’s announcement, but members have been warned to watch for phishing emails, impersonation attempts and other messages that could exploit the exposed addresses.
Bandai says emails it sends about this incident will not contain URLs, giving members an important way to identify suspicious messages claiming to relate to the leak.
Users have been specifically advised not to follow links or enter personal information after receiving suspicious emails connected to the incident.
The security issue comes during a major period of growth for The Gundam Base, with Bandai currently preparing to open three new permanent stores across the US, Japan and Australia within less than a month.
A separate cyberattack affecting Bandai Namco Holdings logistics subsidiary Bandai Logipal was disclosed around the same time, but Bandai has not connected that incident to the breach involving THE GUNDAM BASE MEMBERS.
That separate attack may have exposed shipping information used for Ichiban Kuji ONLINE orders, including customer names, addresses, and telephone numbers, with the number of potentially affected records still under investigation.
Bandai Namco Entertainment and BANDAI SPIRITS say they will continue working with Ymir Link to determine the cause and extent of the Gundam Base leak while introducing measures intended to prevent a recurrence.
If you enjoyed this article, you can see more from us directly in your Google feed by adding us as a preferred source.
This post may contain affiliate links, and Essential Japan may earn a commission if you purchase through them.
