Good Smile Company says malware exposed card data for 2,800 customers

Good Smile Company said a malicious program was present on its online store's credit card payment page from October 21 at 1:55 p.m. JST to October 23 at 7:00 a.m. JST, potentially exposing the cardholder name, full 16-digit card number, expiration date and security code of about 2,800 customers.

The company said it discovered information about the malicious program on October 28 shortly after 6:30 p.m. JST. It has contacted the affected customers separately by email.

Partial card data, including the last four digits and expiration date, may have been exposed for an estimated 402,466 credit cards, excluding duplicates. For previously registered cards, cardholder names and security codes were not exposed, and no registered member information linked to that partial data was exposed, the company said.

Good Smile Company also said 7,673 customers who placed orders on October 22 between shortly before 10:20 p.m. JST and shortly before 11:00 p.m. JST may have had order information exposed, including names, addresses, telephone numbers, email addresses, order details, order amounts and payment methods. Information relating to 202 orders was viewed without authorization, and the company considers all 7,673 associated orders potentially affected.

The online store was taken down on October 23, when the breach was discovered. Good Smile Company said it has strengthened system security and removed the vulnerability, and that the flaw believed to be the cause differs from the PHP vulnerability. The company reported the incident to Japan's Personal Information Protection Commission.