Good Smile Company closes online shop after unauthorised access to member data
The figure maker says management information was viewed without authorisation multiple times between October 19 and October 22, 2026, and the shop's reopening date is undecided.
Good Smile Company announced on October 23, 2026, that third-party unauthorised access to its online store, the Good Smile Company Official Shop, allowed member personal data to be viewed without authorisation. The company has closed the site, and no date has been set for it to reopen, according to ascii.jp.
An examination of system logs showed that management information was viewed without authorisation several times between shortly after 3 p.m. on October 19 and around 10 p.m. on October 22, 2026.
The information that may have been viewed includes names, name readings, gender, addresses, telephone numbers and email addresses. Order dates, product names, quantities, amounts, payment methods and payment status may also be affected, along with the names, addresses and telephone numbers of separately registered delivery destinations.
For card details, the card brand, the last four digits of the number and the expiry date may be affected. The cardholder name, the digits other than the last four and the security code are not included, the company said.
Good Smile Company said it has fixed the vulnerability believed to be the cause and is continuing to investigate and respond. Affected members will be notified by email in sequence once confirmation is complete.
Quick answers
Which information may have been viewed in the Good Smile Company shop breach?
Names, name readings, gender, addresses, telephone numbers and email addresses, plus possible order details, delivery address details and limited card information such as brand, last four digits and expiry date. Cardholder names, the remaining card digits and security codes are not included.
When will the Good Smile Company Official Shop reopen?
The site has been closed and the company says no reopening date has been decided.
How will affected members be told?
The company says it will email members who may be affected in sequence once confirmation is complete.