Good Smile Company discovered a data breach.

Japanese manufacturer and hobby product company Good Smile Company announced that the company discovered a data breach on Friday, October 23rd. This unauthorized third party gained access to the personal information of members of its online store from October 19th to 22nd.

According to the company, the information includes member names, gender, addresses, email addresses, phone numbers, order information, and some credit card information, which include the card brand, the last four digits of a used credit card, as well as expiration date. However, the cardholder's name, any card number digits besides the last four, and the security code for credit cards are not included.

The company's online store is undergoing maintenance and is currently investigating the incident. Good Smile Company claimed that it has since strengthened system security and added that it has removed the vulnerability that it identified as the cause of the security breach. The company has also reported the incident to Japan's Personal Information Protection Commission, in accordance with Japanese law.

On Thursday, October 29th. The company stated that its investigation has established that a malicious program was present on the website's credit card payment page from October 21st to 23rd. The information concerning the installation of the malicious program was discovered on Wednesday, October 28th, and it was stated that the vulnerability believed to be the cause of the issue is different from the PHP vulnerability.

The company now states that 2,800 customers who may have entered their information on the website's credit card payment page during that time may be affected by the issue, and their information such as cardholder's name, complete 16-digit card number, expiration date, and security code may have been exposed. The company stated that it has contacted the affected customers by email separately.

Additionally, the company stated that customers who have previously registered their credit card information on the website may have their partial information exposed, including the last four digits of the card and expiration date.

The company confirmed that cardholders' names or security codes have not been exposed, and no registered member information linked to the exposed partial information was exposed. The company estimated that the number of credit cards that may have partial information exposed is 402,466, excluding duplicates.
.
Source:
- Good Smile Company:
-- https://support.goodsmile.com/hc/en-us/articles/63547468806297-Notice-of-Possible-Exposure-of-Customer-Information-Due-to-Unauthorized-Access-Updated-October-26-2026
-- https://support.goodsmile.com/hc/en-us/articles/63718007508761-Notice-of-Possible-Exposure-of-Customer-Information-Due-to-Unauthorized-Access-Third-Update