Good Smile Company reports card data breach at official store
Unauthorized access may have exposed payment details for 2,800 users, the company said, while the site was closed and inquiries are being accepted.
Good Smile Company said its official e-commerce site suffered unauthorized access and that some users' credit card data may have leaked, according to 4gamer.net. The company reported the incident on October 23, 2026.
Good Smile Company was notified around 6:00 on October 23, 2026 by its system development and maintenance contractor that the site's management information had been viewed via unauthorized access between just after 15:00 on October 19 and 22:00 on October 22, 2026. The official e-commerce site was closed shortly after the report.
A malicious program was found installed on the site's credit card payment information page around 13:55 on October 21, 2026. Users who entered credit card information on the official e-commerce site between that time and around 7:00 on October 23, 2026 may have had their information stolen, even if payment was not completed. Leaked information may include cardholder name, all 16 digits of the card number, expiry date and security code. The number of affected users is 2,800.
Potentially viewed member data includes address, name, gender, phone number, email address, order details such as product names, prices and delivery information, and part of credit card data including card brand, last four digits and expiry date. The number of affected card records is 402,466.
The company said users of external payment services such as Amazon Pay and PayPal do not have credit card data held by the official e-commerce site. The GOOD SMILE STORE Rakuten Ichiba store and Nendoroid Face Maker are operated on separate systems and are out of scope.
Inquiries are being accepted via Good Smile Company customer support's inquiry form.
Quick answers
How many users were affected by the Good Smile Company data breach?
The company said the number of affected users is 2,800, and the number of affected card records is 402,466.
Which services are not affected?
Amazon Pay and PayPal users do not have credit card data held by the official e-commerce site, and the GOOD SMILE STORE Rakuten Ichiba store and Nendoroid Face Maker run on separate systems.
How can I contact Good Smile Company about the incident?
Inquiries are being accepted via Good Smile Company customer support's inquiry form.