Good Smile Company has warned 2,800 customers of possible card data exposure following an attack on its online shop.
Its third incident report, dated October 29, 2026, says malicious code was placed on the card payment page. Potentially exposed details include cardholder names, full card numbers, expiration dates and security codes.
Who should check their card activity?
The 2,800 notified customers may have entered card details between 11:55 a.m. on October 21 and 5 a.m. on October 23 in Vietnam time. That corresponds to 1:55 p.m. on October 21 through 7 a.m. on October 23 in Japan. Good Smile has contacted this group individually by email.
This is not a confirmed count of customers whose full card details were exposed. Missing activity logs meant the company also notified people who may only have added items to a cart without proceeding to checkout. Good Smile believes card information was not exposed for customers who only performed that action.
Customers who attempted but did not complete a card change for an existing order may also be at risk. The company cannot fully identify that group and asks those customers to check their card activity as well.
What other information may be affected?
The report identifies two further categories. Their figures cannot be added to 2,800 as a total victim count because they measure different things and may overlap.
| Data category | Scope reported by the company |
|---|---|
| Partial details of registered cards | The last four digits and expiration dates of 402,466 distinct cards may have been exposed. The number of affected customers is still being established. |
| Order information | 202 orders were accessed without authorization. Because the company cannot identify every specific order, it is warning all customers associated with 7,673 potentially accessible orders. |
Order data may include names, addresses, phone numbers, email addresses, purchased items, order amounts and payment methods. For the partial-card category, the company has not confirmed exposure of cardholder names or security codes.
What should customers do?
Good Smile advises checking for unfamiliar charges and promptly contacting the card issuer using the number on the back of the card if anything looks wrong. It also warns against suspicious links in emails, texts or calls impersonating the company, banks or public authorities.
The shop temporarily closed on October 23. According to the October 29 report, Good Smile has patched the suspected vulnerability and replaced connection credentials between systems. A reopening date will be announced once safety has been confirmed.
Orders and preorders scheduled for October shipment are still being processed. Customers receiving payment-error notices who cannot retry because the shop is closed can use the official support form. The company says preorders in that situation will not be automatically canceled.
Source: Good Smile Company's third incident report, dated October 29, 2026. Figures and response status reflect that report. Product image: Good Smile Company. Checked October 30, 2026.
