Mandarake Data Breach: Personal Info Leaked Review 2026

[Emergency] Mandarake server hacked and personal info leaked: So frustrating.

Hello everyone. Did you check your mailboxes? Today, seeing the notification email from Mandarake really made my blood boil. I can’t even remember the last time I bought a Gunpla here out of nowhere, getting a notice that the server was hacked and personal info was leaked is just absurd.

Many of you reading this probably registered at least once to find rare diorama props or discontinued figures hard to get domestically. Swallowing my anger to prevent any secondary damage, let me quickly organize just the facts.

Mandarake has already shut down their servers immediately and reported the incident to the police.

---

1. Compromised Information

• Target: Orders placed before 6:00 AM on August 28, 2026
• Items: Name, address, phone number, email address

2. Information That Remained Safe

• Credit card info (not stored in the system in the first place)
• Account passwords
• Buyback service user info
• Auction consignment and winning bidder info

They announced that critical things like credit card info and passwords weren’t leaked, but my address and contact info aren’t public goods, so I am genuinely angry. ㅠㅠ Still, I suppose it’s better than nothing.

3. Site Resumption Schedule (They still want to do business amidst all this)

• General Mail Order: Resuming at 12:00 PM on September 5. For those whose payment deadlines were tight, deadlines will be extended by 5 days after site recovery.
• Daily Auction: Resuming from September 7.
• Grand Auction: Entries revealed on September 7, bidding starts September 9.

4. Crucial Precautions

Even though passwords are safe, your name and contact info have been exposed, so expect a surge of phishing calls and smishing texts impersonating Mandarake or delivery companies for a while. Crank up your spam filter settings tightly.

---

Honestly, I only use Mandarake when I miss out on items on AmiAmi or need to find discontinued Gundam Fix or Robot Spirits figures… If you have any other sites where you reuse the same ID and password as Mandarake, don’t procrastinate lying in bed—go change those passwords right away today. I’m sick of the hassle, but I need to go update my passwords immediately. This is truly exhausting. Everyone watch out for spam and stay safe while enjoying your hobbies!

---

< Notice Email Original Text >

Notice and Apology Regarding Potential Personal Information Leak Due to Unauthorized Access

Mandarake Inc.

Representative Director: Yoshiyuki Tanaka

We have confirmed that there was unauthorized access by a third party to our servers, resulting in a possibility that customer personal information may have been leaked.

We sincerely apologize for causing great concern and inconvenience to our customers.

We report the facts confirmed to date and our countermeasures as follows.

As new information requiring disclosure is confirmed, we will promptly notify you through our website and other channels:

https://www.mandarake.co.jp/maintenance.html

Unless otherwise specified, all dates and times in this notice are based on Japan Standard Time (JST).

Background

Around 23:00 on Thursday, August 27, 2026, we detected unauthorized access to our servers.

Judging that there was a possibility of a personal information leak, we immediately stopped the affected servers to prevent further damage and began investigating the cause and scope of the impact.

Subsequently, in accordance with the Act on the Protection of Personal Information, we reported this incident to the Personal Information Protection Commission of Japan and filed a damage report with the police.

Status of Potential Personal Information Leak

We are currently investigating with the support of an external specialized agency. Although no evidence that personal information was actually leaked has been found, we cannot rule out the possibility that some customer information was viewed or exposed.

Importantly, results from investigations so far have confirmed no evidence of credit card information or account passwords being exposed.

Information That May Have Been Exposed:

・Names, addresses, phone numbers, and email addresses related to orders placed before 06:00 on Friday, August 28, 2026.

Information Confirmed NOT to Have Been Exposed:

・Credit card information (Credit card information is not stored or maintained on our system)

・Member account passwords

・Information of members registered for the buyback service

Future Measures and Preventive Measures

We take this situation very seriously. While continuously investigating the cause and closely assessing the scope of the impact, we will strengthen our security systems and formulate recurrence prevention measures.

As a preventive measure, please exercise extreme caution regarding unexpected or suspicious emails, phone calls, or other contacts impersonating Mandarake or related parties in connection with this incident.

Inquiries Regarding This Matter

Mandarake Inc. Web Production Department

Phone: 03-3228-0007

(Follow the voice prompt to press “5” and then “6”.)

Business Hours: Weekdays 12:00 ~ 20:00

Email: [email protected]

---