For: people who have had items delivered through Ichiban Kuji ONLINE, and operators of online shops that hand delivery to an outside logistics company. This article is based on the official announcement by BANDAI NAMCO Holdings, BANDAI SPIRITS and Bandai Logipal and does not cover attack or scam techniques.
Developing: this article will be updated as the organisation publishes more
As of October 28, 2026Not yet known
- How many people are affected, and who (which period of delivery data)
- How the unauthorized access happened, and its cause
- When the shipping system will restart
- How the affected people were alerted
- How Ichiban Kuji ONLINE orders and deliveries are affected
In their October 26 first report, the three companies say details such as the number of people affected are currently under investigation and will be announced once known. They will publish a follow-up when the shipping system's safety is confirmed and it is put back into use, and when new facts that should be announced, such as the count, come to light. When this site checked the BANDAI NAMCO Holdings press release list and the Ichiban Kuji ONLINE news list on October 28, no follow-up (second report) had been published.
What people who had items delivered through Ichiban Kuji ONLINE should do today
Do not answer anything on the spot when you get an unexpected call
The three companies say suspicious phone calls related to the incident may arrive. Topics such as "shipping your Ichiban Kuji prize", "confirming your delivery address" or "an apology and compensation for the data leak" sound natural to anyone who has used Ichiban Kuji ONLINE.
A caller who knows your name or address is not proof that the call is genuine, because that is exactly the information that may have leaked. If you are asked for a card number, bank details, a verification code or your date of birth, do not answer; hang up and check with the official contact point yourself.
Do not contact phone numbers, URLs or QR codes printed on letters
The companies also mention that suspicious postal mail may arrive. In general, someone who knows your address can send letters disguised as invoices, prize notifications, or refund and compensation offers. Do not use the contact details on the letter; check through the official Ichiban Kuji ONLINE website, opened yourself.
To check anything, use the inquiry form on the official website
The contact point for Ichiban Kuji ONLINE members given in the announcement is the Ichiban Kuji ONLINE inquiry form (on-line.1kuji.com). No phone number is given in the announcement. Use this form rather than any other contact point given to you by phone, post or email.
If you receive an alert from the companies, check its content on the official website
The companies say that on October 26 they alerted the people whose information is suspected to have leaked, but they do not say how (for example by email or by post). Because fake messages can be made to look like a genuine notice, do not use links or phone numbers in a notice you receive; check the official website's news and inquiry form instead.
Cards are excluded, and passwords are not mentioned
The companies say credit card details were not included, and passwords are not on the list of information that may have leaked. The announcement does not ask members to change their passwords. If you reuse the same password on other services, now is a good time to change that, which also helps against future fake messages (see Choosing a password manager).
What happened (from the three companies' announcement)
On October 26, 2026, BANDAI NAMCO Holdings Inc., BANDAI SPIRITS CO., LTD. and Bandai Logipal Co., Ltd. published "Notice regarding unauthorized access to Bandai Logipal Co., Ltd. (first report)". Bandai Logipal is the logistics subsidiary of BANDAI NAMCO Holdings. Ichiban Kuji ONLINE is a BANDAI SPIRITS service, and BANDAI SPIRITS outsources its product delivery to Bandai Logipal. Everything below comes from the three companies' announcement.
October 21, 2026 (Wed)
Traces suggesting unauthorized access found on a server in the logistics system managed by Bandai Logipal. The server was shut down immediately and an investigation into the cause and scope began. On the same day, the company confirmed that operations had been carried out through misuse of a company account, and took emergency measures.October 22 (Thu)
Bandai Logipal set up an internal task force and investigated the whole logistics system. Traces suggesting unauthorized access were confirmed on the server that stores Ichiban Kuji ONLINE delivery information, and it emerged that some registered customer information was suspected to have leaked.October 23 (Fri)
The extent that the unauthorized operations may have reached was identified. The company decided to stop the system until the full investigation and countermeasures were complete, and began shutting it down.October 24 (Sat)
The logistics system in question was stopped.October 26 (Mon)
Reported to the police and the Personal Information Protection Commission. The people whose information is suspected to have leaked were alerted, and business partners affected by the system stoppage were notified. The first report was published.
BANDAI SPIRITS: Ichiban Kuji ONLINE
Outsources product delivery to Bandai Logipal
Bandai Logipal's logistics system
Traces suggesting unauthorized access on the server that stores Ichiban Kuji ONLINE delivery information
Names, addresses and phone numbers may have leaked. Card details not included (the three companies)
↓ What can happen (in general)
Suspicious calls or letters claiming to be from Ichiban Kuji or Bandai
Do not answer on the spot; check through the official website's inquiry form
- System accessed
- A system managed by Bandai Logipal (a server in its logistics system). Traces suggesting unauthorized access were confirmed on the server that stores Ichiban Kuji ONLINE delivery information
- Information that may have leaked
- Ichiban Kuji ONLINE delivery information (name, address, phone number)
- Not included
- Credit card details
- Number affected
- Under investigation (to be announced once known)
- Misuse
- None confirmed so far
- What was stopped
- The logistics system in question was stopped on October 24. The main text says Bandai Logipal's shipping system in question is suspended from October 26 until its safety is confirmed
- Reports
- Reported to the police and the Personal Information Protection Commission on October 26
- Contact
- For Ichiban Kuji ONLINE members: the Ichiban Kuji ONLINE inquiry form (on-line.1kuji.com)
What is known and what is not
Organised from the three companies' October 26 first report, as of October 28, 2026. When a follow-up is published, the status column will be updated.
| Item | What the announcement says | Status |
|---|---|---|
| Name (delivery information) | Listed as personal information that may have leaked | Possible (the three companies) |
| Address (delivery information) | Listed as personal information that may have leaked | Possible (the three companies) |
| Phone number (delivery information) | Listed as personal information that may have leaked | Possible (the three companies) |
| Credit card details | Not included | Not included (the three companies) |
| Email address | Not on the list of information that may have leaked | Not mentioned |
| Password | Not on the list of information that may have leaked | Not mentioned |
| Order contents (item names etc.) | Not on the list of information that may have leaked | Not mentioned |
| Number of people affected, and who | Currently under investigation; to be announced once known | Under investigation |
| Misuse | None confirmed so far | Not confirmed (the three companies) |
| Account misuse | On October 21, operations through misuse of a Bandai Logipal account were confirmed | Confirmed (the three companies) |
| How the access happened, and its cause | Not stated (the companies say they began identifying and responding to the attack method) | Not mentioned |
| Alerts to affected people | Sent on October 26; method not stated | Confirmed (the three companies) |
| Shipping system suspension and restart | Suspended from October 26; a follow-up will be published when it restarts | Confirmed (the three companies) |
| Effect on Ichiban Kuji ONLINE orders and deliveries | Not stated | Not mentioned |
"Not mentioned" does not mean "did not leak"
Email addresses, passwords and order contents are simply absent from the list of information that may have leaked; the companies do not say they were excluded (credit card details are the only item they explicitly say were not included). Also, the announcement's timeline says "the logistics system in question" was stopped on October 24, while the main text says "the shipping system in question" is suspended from October 26. The relationship between the two is not explained, so this article uses the announcement's wording as it stands.
What can happen with a name, address and phone number
In general, when a recipient's name, address and phone number are linked to the fact that they used Ichiban Kuji ONLINE, the following can happen (there is no announcement that any of this has happened in this incident, and the companies say no misuse has been confirmed so far).
What can happen in general
- Calls claiming to be from Ichiban Kuji or Bandai, using "shipping your prize" or "confirming your delivery address" as a pretext
- Calls posing as "compensation for the data leak" or a "refund" to get bank or card details
- Letters disguised as invoices, prize notifications or apologies that steer you to fake contact details
- Texts to your phone number posing as a delivery company or online shop
What you can do
- On the phone, do not answer on the spot; hang up first
- Check through the official website opened yourself, not the contact details on a letter
- Never give card numbers, bank details or verification codes by phone or post
- Use the inquiry form given in the announcement for questions
Phone calls and letters do not pass through a spam filter the way email does, and people tend to trust a caller or sender who knows their name and address. For a past case in which delivery recipients' information leaked, the Yamato Transport and Sagawa Express breach also covers how to prepare for fake missed-delivery notices and payment demands.
For operators who hand delivery to an outside logistics company
How the unauthorized access happened has not been published. This section sticks to what can be said from the published timeline (these are general points to review, not guesses about the cause).
Know where delivery data handed to the logistics side is kept, and for how long
In this case, the information that may have leaked is delivery information that an online service's operator handed to a logistics company (in the announcement, both are Bandai Namco group companies). In general, names, addresses and phone numbers handed over for delivery can remain on the logistics side's servers after shipping is complete. Agreeing with the contractor on how long the data is kept, and that it is deleted after that, reduces the number of people affected if an incident happens.
Make business account activity something you can see and notice
According to the announcement, on the same day the traces were found, the company confirmed that operations had been carried out through misuse of an account. It does not say how the account was misused. In general, protecting accounts on logistics and other business systems with multi-factor authentication, and logging activity so that unusual times or operations can be checked, helps you notice problems sooner.
Decide in advance who tells whom what when a system is stopped
In this case, the server was shut down on the day the traces were found; the logistics system in question was stopped 3 days later, and the announcement and reports to the authorities came 5 days later. The announcement says business partners affected by the stoppage were also notified. In general, stopping a logistics system affects the client's online service and partners' shipments. Settle in the contract and procedures, in advance, who tells the client service's users and how.
Sources (public record)
The facts in this article are based on the public information below. Counts, causes and attack methods that have not been published are not guessed at.
- BANDAI NAMCO Holdings Inc., BANDAI SPIRITS CO., LTD. and Bandai Logipal Co., Ltd., "Notice regarding unauthorized access to Bandai Logipal Co., Ltd. (first report)" (Japanese, October 26, 2026, PDF; checked October 28) — bandainamco.co.jp
- Ichiban Kuji ONLINE news list (Japanese; checked October 28, no notice about this incident listed) — on-line.1kuji.com
Update history
2026-10-28: First version, based on the three companies' first report of October 26. This article will be updated when follow-ups on the count, the shipping system's restart or other details are published.
Read next
- Another case in which delivery recipients' information leaked: The Yamato Transport and Sagawa Express breach (parcel senders and recipients)
- Another case at an anime and hobby goods retailer: The Lashinbang breach
- Spotting fake messages: What is phishing? / Smartphone security basics
- Other 2026 incidents: List of data breaches and cyberattacks (Japan and worldwide)