← Good Smile Company

2026 Good Smile Company — official online store breach; customer names, contact details and order histories may have been viewed; count not disclosed

2026 Unknown records affected Share on X

Data compromised

Names and phonetic readings, gender, postal addresses, phone numbers and email addresses. Order records: dates, products, quantities, prices, shipping and recipient details, and payment method and status. Partial card data: card brand, expiry date and last four digits. Not included: full card numbers, cardholder names and security codes, and Amazon Pay and PayPal payment details, which the company does not store. The company has not stated how many customers are affected.

Technical writeup

The company reported the incident to Japan's Personal Information Protection Commission on October 23 and plans to email potentially affected customers individually as its checks progress. The global online store at goodsmile.com is offline with no reopening date. The company says the US store (goodsmileus.com), the Europe and UK shops, the Nendoroid Face Maker site and the Rakuten store were not affected. The company has not identified passwords as exposed.

Root cause

The company says its online store administration system was accessed without authorisation on multiple occasions from about 3 p.m. JST on October 19 to about 10 p.m. on October 22. It believes attackers exploited a vulnerability in the store system but has not named the flaw. It says a PHP issue patched during October 21–22 maintenance was not the cause. The outside provider that runs the store told the company about the problem.

References

Breaches you may like