Bandai Namco Data Breach Hits Over 300,000 Users as Third-Party Leak Exposes Millions of Records

The studio behind iconic titles like Tekken, Bandai Namco, has confirmed a data breach through its third-party email service provider, YmirLink. This has exposed the email addresses and internal IDs of around 346,000 members of The GUNDAM base. The incident is part of a much larger data leak at YmirLink, which has exposed more than 51.62 million records.

While the breach is concerning for affected users, there is some good news. The official statement released on October 28, 2026, which has now been taken down, stated that the exposed information is limited to email addresses and internal Bandai Namco ID numbers. Passwords, credit card details, names, addresses, and purchase history were not leaked, unlike Sony’s latest data Breach.

Additionally, as stated by Bandai Namco, the exposed email addresses could still pose a threat, as they can be used for phishing scams or impersonation attempts. To mitigate the risks, the company has warned users to remain cautious of suspicious emails and said that emails regarding the incident will not contain any URLs in their body.

Following the incident, the company has also suspended the affected email distribution service and reported the breach to Japan’s Personal Information Protection Commission. The company also stated that no secondary damage, such as unauthorized use of personal information, had been confirmed at the time of announcement.

However, it will continue investigating the incident alongside YmirLink to determine its full impact. This data breach is part of a much larger data leak at YmirLink. According to Japanese news outlet NHK One, YmirLink initially reported around 9 million leaked records on October 19th, but further investigation increased the number to over 51.62 million.

This data breach primarily consists of email addresses and affects various other organizations using YmirLink’s services, which includes Japanese railway operators JR Central, JR West, and JR Kyushu, who have also reported potential data leaks.

With the investigation still ongoing, the full extent of the breach and the number of affected records could increase further. For now, the best strategy for everyone affected would be to avoid clicking suspicious links, especially given that Capcom was also breached last week.