Duel Masters: App Flaw Affects Up to 155,000 Users

Takara Tomy reports a security vulnerability in the Duel Masters Support App that has since been fixed. Under certain conditions, personal data of up to 155,000 registered users may have been viewable by third parties.

According to the company, the affected period runs from the app's launch on August 1, 2025 until the technical correction was completed on July 13, 2026. The cause was a weakness in the design and implementation of user registration.

The information that may have been viewable includes name, address, phone number, gender, date of birth, and email address. Also included are the internal service ID, the display name used, and the X user ID. The figure of around 155,000 people is a maximum value calculated from all users registered during the affected period.

No Confirmed Misuse

Takara Tomy emphasizes that it has so far found neither actual access by third parties nor any misuse of the data. The report therefore describes a possible disclosure, not a confirmed leak of all listed information.

The company does not currently require a password change or other special steps. However, users should report it if they receive suspicious emails, SMS messages, or calls that impersonate Takara Tomy or the app, or if they notice unfamiliar activity in their accounts.

The free app for iOS and Android is used to search for and manage cards and decks and to register for events. According to KAI-YOU, in Japan's competitive system the app is also used to submit decklists at larger events and official tournaments.

Takara Tomy announces that it will strengthen employee training and the security review of its app services. The company had recently also expanded worldwide production of BEYBLADE X; the current case, by contrast, concerns the handling of user data within a digital tournament service.