October 23, 2026: Good Smile Company, the Japanese maker of Nendoroid figures, said attackers had accessed its official online store without authorisation between about October 19 and October 22. The data that may have been viewed includes names, contact details and order histories, plus partial card details. The company says full card numbers and security codes were not included. It has not said how many customers were affected, and the store is closed. The catalog entry records the company's statements.
What happened
The company says its online store's administration system was accessed on several occasions between about 3 p.m. Japan time on October 19 and about 10 p.m. on October 22. It learned of the problem from the outside provider that runs the store. It believes attackers exploited a vulnerability in the store system, but it has not named the flaw. It says a PHP issue it patched during maintenance on October 21 and 22 was not the cause. The company reported the incident to Japan's Personal Information Protection Commission on October 23.
What data may have been viewed
- Names, including phonetic readings, and gender.
- Postal addresses, phone numbers and email addresses.
- Order records: dates, products, quantities, prices, shipping and recipient details, and payment method and status.
- Partial card data: card brand, expiry date and the last four digits.
What the company says was not included
- Full card numbers, cardholder names and security codes.
- Amazon Pay and PayPal payment details, which the company does not store.
- Passwords. The company has not identified them as exposed.
Verified and unverified
- Confirmed by the company: unauthorised access during the October 19–22 window; the data categories above; the exclusions above; the store closure; the notice to Japan's privacy regulator.
- Unverified: how many customers are affected, which the company has not stated; the flaw; and the attackers. Reports of a 270,000-customer exposure have circulated, but they tie to a different claim, and we could not confirm them.
Which stores are affected
The company says its global online store at goodsmile.com is the one affected. It says the US store, the Europe and UK shops, the Nendoroid Face Maker site and the Rakuten store run on separate systems and were not affected.
Who may be affected
- Customers who ordered from the official online store, including older orders, because order histories were in scope.
- Anyone whose contact details were on the store, who may be targeted by impersonation messages.
What to do
- Expect an individual email from the company as its checks progress. Do not treat messages that claim to reopen the store, refund an order or verify a payment as genuine unless they match the company's notices.
- Verify any payment or account request by contacting the company through its official support channel, not through a link in the message.
- Do not enter card details on any page reached from an email, text or phone call.
- Check card statements for charges you do not recognise. The exposed card brand, expiry date and last four digits could be used in phishing, so watch for unusual messages from your card issuer or payment provider.
- If you use the same password on other sites, change it. The company has not reported that passwords were exposed.
Sources and sourcing note
- Good Smile Company, "Notice of Possible Exposure of Customer Information Due to Unauthorized Access" (updated October 26, 2026)
- eSecurity Planet, "Good Smile Company Data Breach: Customer Details Exposed, Store Shut Down"
- Essential Japan, "Good Smile Company Shuts Down Official Online Store After Major Security Incident," October 24, 2026
Sourcing note: the company's notice is cited from the two news reports above, because our tools could not open the notice page directly (it returned an access error). The company has not disclosed a customer count. This post will be updated when the company publishes one or reopens the store.