Bandai Namco Entertainment and BANDAI SPIRITS said on 27 October that the email addresses of 346,247 members of THE GUNDAM BASE MEMBERS were taken in a breach at Ymir Link, the outside contractor that runs the programme’s mail delivery. The notice on the Bandai Namco ID portal says Ymir Link reported on 26 October that an intruder had accessed the mail environment used by the membership service and taken email address data.
The leaked data is limited to email addresses and internal identifiers used to manage Bandai Namco ID accounts. Names, postal addresses, purchase histories, login passwords and credit card details were not included, according to the companies, and no secondary damage had been confirmed when the notice went out. They stopped the mail service for THE GUNDAM BASE MEMBERS, reported the incident to Japan’s Personal Information Protection Commission the same day and say they will contact affected members individually. Former members who cannot be reached are covered by the public notice. Bandai Namco ID, the group’s shared account, and the other services that use it remain available.
The immediate risk is phishing aimed at a known list of Gunpla fans. The companies say their own emails about the incident will contain no URLs, and ask members not to open links or enter details in suspicious messages.
THE GUNDAM BASE is Bandai Namco’s chain of official Gunpla model-kit stores; its official site lists the largest at DiverCity Tokyo Plaza in Odaiba and a flagship shop in Fukuoka. Ymir Link, a Japanese provider of bulk email systems, first disclosed on 19 October that outsiders had accessed some of its servers and estimated that about 9 million records, counted cumulatively and including email addresses, had been extracted, ScanNetSecurity reported. The Bandai Namco notice says Ymir Link is still checking the other environments it manages, so more client companies may follow with their own notices.