JP — ITmedia

Bandai Namco Logistics Subsidiary Hit by Unauthorized Access, Possible Leak of "Ichiban Kuji ONLINE" Delivery Data

SecurityOctober 27, 20262 min read

Bandai Namco's logistics subsidiary, Bandai Logipal, may have leaked shipping data for the online lottery service "Ichiban Kuji ONLINE" after a hacker broke into its system. Names, addresses and phone numbers may be affected.

What happened

On October 26, Bandai Namco Holdings said that a hacker got into a system run by Bandai Logipal. The system holds shipping details for Ichiban Kuji ONLINE orders. The company says personal data may have leaked. It has not yet said how many people are affected. Credit card information was not included, and no misuse has been confirmed so far.

Key facts and dates

October 21: Bandai Logipal found signs of unauthorized access on a server and shut it down.
October 21: It found that a Bandai Logipal account had been used illegally.
October 22: It set up an internal response team and found the same kind of signs on the server that stores Ichiban Kuji ONLINE shipping data.
October 23–24: It decided to stop the system and did so. The system will stay offline until it is confirmed safe.
October 26: It reported the case to the police and the Personal Information Protection Commission, and warned people who may be affected.

Background

Ichiban Kuji is a popular Japanese prize lottery where buyers draw lots to win collectible goods. Bandai Namco's subsidiary BANDAI SPIRITS outsources the shipping of Ichiban Kuji ONLINE products to Bandai Logipal. This means a company outside the main brand handled the customer data, and a breach there still affected the brand's customers.

Why it matters

Shipping data can be used to make fake calls or mail that look real. The company asks people to be careful with any unexpected phone call or letter, even if it seems related to their order. The case also shows that companies that work with other firms can be a weak point for security.

What to watch

How many people were affected, which the company is still checking.
Whether any leaked data is misused, such as scam calls or mail.
When the Ichiban Kuji ONLINE system will restart, and what security changes are made.

Glossary

Bandai Logipal: A logistics subsidiary of Bandai Namco that manages the systems used to ship products.
Ichiban Kuji ONLINE: An online service where people buy and draw prize lottery goods from Ichiban Kuji.
Personal Information Protection Commission: A Japanese government body that watches over how companies protect personal data.

LiteLLM supply chain attack started with an exposed master key

LiteLLM traced last week's supply chain attack to a master key it accidentally committed to a public GitHub repository in May, which was not revoked after the commit was removed. The attacker used the key to access the company's AI agent platform and steal a GitHub CLI OAuth token, gaining owner-level access to its GitHub repositories. A poisoned version (1.107.0) of the package, which contained an infostealer and a remote access trojan, was available on PyPI for under two hours and was downloaded about 49,000 times, according to Wiz.

SecurityZDNet KoreaOct 27

"Threatening the Entire Server Ecosystem"... After PHP, Security Vulnerability Found in Node.js Too

A critical vulnerability dubbed "Node2shell" (CVE-2026-111497) has been found in Node.js, the JavaScript server runtime, following a similar PHP flaw. AI offensive security firm Theori says it reproduced and verified the flaw, which stems from an out-of-bounds write in the Brotli decompression module and can allow denial of service or remote code execution without authentication. Node.js versions 22.x, 24.x, and 26.x without the latest security patches are affected, and Theori urges immediate updates to 22.23.4, 24.22.1, or 26.12.1 or later.

Securityheise onlineOct 27

Cloudflare CEO Expects Many More Flaws Like php2shell

Cloudflare CEO Matthew Prince told Reuters that the recently disclosed php2shell and Broccoli2Shell vulnerabilities are only the beginning, and that for years weekly alarms like these may occur as more people use AI to search for security flaws. He said Cloudflare knows of several other serious vulnerabilities in critical software components but did not name the affected projects. Security firms such as VulnCheck and secuvera also expect the time between vulnerability discovery and attacks to keep shrinking.

SecurityThe RegisterOct 27

Microsoft releases emergency .NET security fixes for Google Brotli bug

Microsoft has issued an out-of-band security update for .NET 8, 9, 10, and 11 to patch a buffer overflow in Google's Brotli compression library, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1. The flaw could let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service, or elevation of privilege. Microsoft's advisory says exploitation is "More Likely," though it found no evidence yet that criminals are using working exploits in attacks.