Good Smile breach: full card details of about 2,800 shop customers may have leaked, 400,000 more cards partly exposed
Good Smile Company said in its October 29, 2026 third update that malicious software on its online shop’s payment page may have leaked the full card details — name, 16-digit number, expiry date and security code — of about 2,800 customers, that last-four digits and expiry dates for 402,466 saved cards may also have been exposed, and that order details for 7,673 customers are treated as potentially affected.
What happened
Good Smile Company, the Japanese maker of Nendoroid figures, published a third update on October 29, 2026 on the breach of its official online shop, first announced on October 23. The company confirmed several instances of unauthorised access to the website between 3:00 p.m. on October 19 and just before 11:00 p.m. on October 22, which it believes came through a vulnerability in the website’s system that gave the attacker administrative privileges; the shop was closed on October 23 and remains closed until its security is assured. The most serious finding came later: on October 28, the company discovered malicious software had been installed on the shop’s payment page from 1:55 p.m. on October 21 to 7:00 a.m. on October 23. The company said the incident is not related to the recently reported PHP vulnerability, has reported it to the Personal Information Protection Commission, and is contacting credit card companies and payment gateways.
Who is affected
Three groups. First, about 2,800 customers who entered card details on the payment page while the malicious software was live, whom the company has notified individually by email: their cardholder name, full 16-digit card number, expiration date and security code may have leaked. That group includes 384 customers who completed a card payment and 185 who updated a card after pre-ordering, along with people who attempted payment and people who only added items to a cart — the company says cart-only users very likely were not compromised, but its logs could not separate them, so it notified everyone. Second, 402,466 previously saved cards (excluding duplicates), for which only the last four digits and expiration date may have been exposed; the company says no breach of names, security codes or linked member information has been confirmed for that set. Third, 7,673 customers whose orders were placed in a window on October 22 when 202 order records were viewed without authorisation, whose names, addresses and phone numbers are treated as potentially compromised.
The alarm was raised by the vendor that builds and maintains the shop platform on the morning of October 23, and Good Smile shut the store at 7:00 a.m. that day; the payment-page malware was only found five days later, on October 28, which is why the full-card warning arrived in the third update rather than the first. The company plans to announce a reopening date only once vulnerability fixes and connection credential updates are complete and security is assured. Its US, European and UK stores run on separate systems and were not part of this incident.
How serious
For the 2,800 payment-page customers, this is as serious as card exposure gets: a full card number together with the expiry date and the security code is everything a fraudster needs to attempt purchases on sites that do not require further verification, and the company is urging those customers to check their statements and contact their card issuer. The 402,466 saved cards are a much lower risk on their own — a last-four and an expiry date cannot charge a card — but they give scammers a true detail to quote in a convincing fake “Good Smile support” message. The order-information group faces the targeted-phishing risk that follows any leak of names, addresses and phone numbers tied to real purchases.
What to do now
If you entered a card on the Good Smile Company official online shop between October 21 and 23, contact your card issuer now, check your statements for charges you do not recognise, and ask the issuer about reissuing the card — the company is urging notified customers to do exactly that. If you only had a saved card on the shop, a statement check is the proportionate step, and treat any “support” message quoting your card’s last four digits as a likely scam: reach the company only through its official site. Everyone in the order-information group should expect phishing that cites a real order, and verify any refund or re-delivery request through official channels before acting.
Sources: AUTOMATON WEST, October 29, 2026 · Inven Global, October 29, 2026