Good Smile Company to Restore Product Browsing on November 6 After Store Breach

Good Smile Company announced Thursday that its online store will reopen for product browsing only on Friday, November 6. The reopening follows a breach in which an unauthorized third party accessed members’ personal and other information.

The company restored the store from a backup to its condition before the unauthorized access. It also fixed vulnerabilities in its administration system and reinforced procedures to prevent another incident.

Good Smile plans to strengthen its web application firewall against cyberattacks and introduce 24-hour monitoring. According to the company, independent security specialists found that browsing the site presents no risk of viruses or unauthorized access to customer information.

The following functions will remain unavailable until the independent investigation and security measures are complete:

• Account information access
• New account registration
• New orders
• Cart additions
• Watchlist functions

Good Smile took the store offline after discovering the breach on October 23 and continues to investigate. It said it strengthened system security and removed the vulnerability it identified as the breach’s cause.

The company also reported the incident to Japan’s Personal Information Protection Commission, as Japanese law requires.

Investigators established that a malicious program operated on the website’s credit card payment page from October 21 at 1:55 p.m. JST until October 23 at 7:00 a.m. JST.

Information about the program’s installation emerged shortly after 6:30 p.m. JST on October 28. Good Smile said the vulnerability believed responsible differs from the PHP vulnerability.

The company said 2,800 customers who may have entered information on the credit card payment page during that period could be affected. Potentially exposed details include:

• Cardholder’s name
• Full 16-digit card number
• Expiration date
• Security code

Good Smile said it separately emailed the affected customers.

Customers who previously saved credit card information on the website may also have had partial details exposed: their cards’ last four digits and expiration dates.

The company confirmed that this exposure did not include cardholders’ names, security codes or registered member information linked to those partial details. It estimated that 402,466 credit cards could be affected, excluding duplicates.

Good Smile also said 7,673 customers who ordered on October 22, between shortly before 10:20 p.m. JST and shortly before 11:00 p.m. JST, may have had order information exposed.

The potentially exposed order details include:

• Shipping and/or billing name
• Shipping and/or billing address
• Shipping and/or billing telephone number
• Email address
• Order details
• Order amount
• Payment method

The company confirmed that someone viewed information from 202 orders without authorization. Its website system cannot fully identify which orders were viewed, so it considers all customers associated with the 7,673 orders potentially affected.

Good Smile develops video games, manufactures hobby and toy merchandise, produces anime and operates online retail. Its signature toy brands include the popular Nendoroid and Figma figure lines.

Nendoroids depict anime, manga and pop culture characters as small, super-deformed figures that may offer limited posing and interchangeable faces. Figma action figures feature characters from those same fields, emphasizing extensive articulation and poseability.