Bandai Logipal: unauthorized access; Ichiban Kuji ONLINE delivery data may have leaked
On 21 October Bandai Logipal, the Bandai Namco group's logistics company, found signs of unauthorized access on a logistics system server, shut it down and confirmed that one of its accounts had been misused. On the 22nd traces were also found on the server holding delivery data for Ichiban Kuji ONLINE, which BANDAI SPIRITS contracts it to ship, so names, addresses and phone numbers may have leaked. No card data is involved and the count is under investigation. The shipping system was stopped on the 24th and stays down until it is confirmed safe. The case was reported to the police and the Personal Information Protection Commission on the 26th.
Disclosed
2026-10-26
Organizations involved
2
Leaked or at risk
Unknown
Downtime
Unknown
Timeline
- Detected 2026-10-21
- Disclosed 2026-10-26
- 5 days
Attack or cause
- Method
- [Intrusion][Credential abuse]
- Impact
- [Data leak][Service outage]
- Entry point
- Unknown
Data exposed or at risk
Supply chain
- Organizations listed on this site
- 2
Services hit
Organizations involved
[Breached][Critical]Tokyo, KatsushikaTransport and postal services
Bandai Logipal Inc.[Through a supplier][Major]Tokyo, MinatoWholesale and retail trade
BANDAI SPIRITS Co., Ltd.Contracts it to ship Ichiban Kuji ONLINE orders; recipients' names, addresses and phone numbers may have leaked.
Sources
- [1][Official]株式会社バンダイロジパルへの不正アクセスについてのお知らせ(第1報)Bandai Namco Holdings · 2026-10-26
- [2][News]「一番くじ ONLINE」の配送情報漏えいか バンダイナムコの物流子会社に不正アクセスITmedia NEWS · 2026-10-27
- [3][News]バンナムHD、物流子会社に不正アクセス 一番くじの顧客情報流出かNikkei · 2026-10-26
- [4][News]バンダイナムコ「一番くじONLINE」、顧客情報の一部流出か…配送子会社に不正アクセスThe Yomiuri Shimbun · 2026-10-26