Good Smile Company has confirmed its worst-case scenario: full credit card details belonging to about 2,800 customers may have been exposed after hackers planted malware on the company’s official online shop. The update, posted on October 29, is the third public notice since the figure maker first revealed the breach on October 23.
Nendoroid figures (Credits: Good Smile Company)
Good Smile Company Third Update: What Was Exposed
According to the company’s official notice, malicious software was installed on the payment page of its online shop between 1:55 p.m. JST on October 21 and 7:00 a.m. JST on October 23, 2026. Through that window, exposed data may have included cardholder names, full 16-digit card numbers, expiration dates, and security codes.
The company said it first detected unauthorized access to its store’s admin system on multiple occasions between October 19 and October 22, and shut the shop down at 7:00 a.m. on October 23. The malware itself was discovered around 6:30 p.m. on October 28. The cause is believed to be a vulnerability exploited for admin privileges, and the company says it is not related to the recently reported PHP vulnerability.
Who Is Affected by the Good Smile Breach
The 2,800 affected customers include 384 people who completed credit card payments, 185 who updated card details after pre-ordering, plus shoppers who attempted payment without completing it and users who added items to their carts while logged in. Good Smile says people who only added items to carts were likely not exposed, but were notified anyway because the system logs could not tell the two groups apart.
A separate investigation covers saved card profiles: the last four digits of card numbers and expiration dates for 402,466 unique cards may have been viewed, though cardholder names and security codes in that group were not compromised. Customers paying through Amazon Pay, PayPal, or the company’s US, European, UK, and Rakuten stores are not affected.
Also Read: Good Smile Company Confirms Data Breach: Online Store Customer Data Accessed October 19-22
Source: Anime News Network — read the full story there.
