Good Smile Company says card data of about 2,800 may have leaked
The figure maker says a malicious program was on its shop's payment page from 13:55 on October 21 to 7:00 on October 23, 2026, and it is emailing each customer.
Good Smile Company said in a third report on the breach of its official shop that credit card data for about 2,800 people may have leaked, gamespark.jp reported. The data includes cardholder names, all 16 card digits, expiry dates and security codes.
The company said a malicious program was present on the shop's credit card payment page between 13:55 on October 21 and 7:00 on October 23, 2026. It believes a vulnerability in part of the site's system was exploited to gain administrator privileges, and said the cause was not a recently reported PHP vulnerability.
The shop was closed at 7:00 on October 23, 2026, after the contractor handling development and maintenance reported unauthorized access.
The roughly 2,800 potentially affected people include 384 who ordered by credit card and 185 who changed their card details after booking, along with others who attempted payment or reached the cart without completing checkout. Good Smile Company is contacting every potentially affected customer individually by email because its systems cannot distinguish some groups of users.
According to the background the company has previously set out, the contractor reported unauthorized access that occurred between 15:00 on October 19 and just before 23:00 on October 22, 2026, shortly after 6:00 on October 23, 2026.
Quick answers
How many customers may be affected by the Good Smile Company shop breach?
About 2,800 people, according to the company's third report.
What card data may have leaked?
Cardholder names, all 16 card digits, expiry dates and security codes.
Is the Good Smile Company Official Shop still closed?
The company said the shop was closed at 7:00 on October 23, 2026, after unauthorized access was reported.