Industry
Good Smile Company: New figures on the shop data leak
The figure maker corrects the number of customers whose order data may have been affected. The separate warning about full credit card data remains unchanged.
On October 30, 2026, Good Smile Company corrected its information on the order data that may have been affected following the attack on its official online shop. Instead of the 7,673 people initially named, the newly defined group comprises 5,356 customers. The figure of 2,800 people whose full credit card data could be affected remains unchanged. The shop will remain closed for the time being.
Why Good Smile is correcting the customer number
In its fourth official investigation report dated October 30, the figure maker specifies the orders whose information may have been viewed. At most 202 orders may have been affected, out of 7,774 orders that had not yet been fully processed at the time, which belong to 5,356 customers. According to the company, it is technically impossible to determine which 202 records were actually viewed. Good Smile therefore notified all 5,356 people by email as a precaution.
Previously, the company had wrongly named 7,673 customers and limited the possible access to a narrow order time window on October 22. The new definition, by contrast, refers to open orders up to October 22 at 11 p.m. Japan time, regardless of the original order time.
The order information that may have been viewed includes names, shipping and billing addresses, phone numbers, email addresses, purchased items, amounts, and the chosen payment method. Specific account or credit card data does not belong to this order data complex.
Credit card data of 2,800 people possibly affected
A separate group of 2,800 people remains unchanged: between October 21 at 1 p.m. and October 23 at 7 a.m. Japan time, a malicious program was installed on the credit card payment page. Here, the outflow of cardholder names, full card numbers, expiration dates, and security codes is possible.
The 2,800 are not a confirmed number of cardholders who were actually robbed. This also includes people who did not complete a payment or who merely placed products in their shopping cart. For another group, the last four card digits and the expiration date of up to 402,466 stored cards may have been viewed. This figure describes cards, not individual people.
Shop remains closed, orders are being processed
According to current findings, the attackers exploited a vulnerability in the shop. Good Smile reports that this has since been fixed and additional protective measures have been implemented. No date for reopening has been set yet. According to the company, orders already accepted and pre-orders with planned October shipping will continue to be processed.
Customers who received a warning email are asked to check card statements for unknown transactions and to contact their card issuer if anything appears suspicious. The company also warns against fraudulent messages and refers questions to its official customer service.
Good Smile manufactures, among other things, anime collectible figures such as the announced Tomie x Hello Kitty figure. Further security incidents in the Japanese pop culture sector involve the manga platform Comic Cmoa and the Duel Masters app.