Good Smile Company Data Breach: Customer Details Exposed, Store Shut Down

Good Smile Company has confirmed unauthorized access to its online store, with customer information viewed by an outside party. The breach potentially exposed personal details, purchase histories, and partial payment-card information.

The Japanese collectibles manufacturer, known for its popular Nendoroid figures, disclosed the security incident on Oct. 23. An unauthorized third party accessed the store's administrative system between Oct. 19 and Oct. 22, prompting the company to shut down the website. An Oct. 26 update provided additional information about the incident and its potential impact on customers.

For collectors with outstanding orders or stored personal information, the immediate questions are whether their accounts were affected, whether their payment information is safe, and what they should do while the online store remains unavailable.

What information was exposed in the Good Smile Company breach?

According to Good Smile Company, an unauthorized third party accessed and viewed information within its online store's administrative system multiple times between shortly after 3 p.m. Japan Standard Time on Oct. 19 and approximately 10 p.m. on Oct. 22.

The information that may have been viewed includes:

• Personal information: Customer names, phonetic spellings of names, gender, mailing addresses, telephone numbers, and email addresses.
• Purchase information: Order dates, product names, quantities, prices, shipping addresses, recipient contact details, payment methods, and payment status.
• Partial payment-card information: Card brands, expiration dates, and the final four digits of card numbers.

Good Smile Company said full card numbers, cardholder names, and security codes were not included in the potentially exposed information.

The company has not disclosed how many customers were affected or the total number of records potentially exposed.

Good Smile Company believes the unauthorized access resulted from exploitation of a vulnerability in its online store system. The company said it strengthened its security systems, addressed the suspected vulnerability, and reported the incident to Japan's Personal Information Protection Commission.

However, it has not publicly identified the vulnerability, and the investigation remains ongoing. In its Oct. 26 update, Good Smile Company said the breach was not caused by a PHP vulnerability, which it had separately addressed during maintenance on Oct. 21–22.

The company first learned of the unauthorized access on Oct. 23 after receiving a notification from the service provider that develops and maintains its online store.

The potential phishing risk resembles concerns raised in eSecurity Planet's coverage of the ASOS customer data incident, although the two breaches involved different circumstances.

Which Good Smile Company stores and payment services were affected?

Good Smile Company clarified that several related stores and services operate on separate systems and were not affected by this incident.

These include Good Smile Company US, Good Smile Company Europe Online Shop, Good Smile Company Europe, Good Smile Company UK, Nendoroid Face Maker, and its Rakuten marketplace store.

The company also said credit card information associated with purchases made through external payment services, including Amazon Pay and PayPal, was not exposed through the compromised store because those payment details were not stored on its servers.

However, that distinction does not necessarily rule out exposure of associated order or contact information. The affected online store remains temporarily closed, and Good Smile Company has not announced a reopening date. The company said it continues to process and ship existing orders and preorders scheduled for October, even as its online store remains unavailable.

Customers experiencing payment errors while the store is closed can contact support. Good Smile Company said that affected preorders will not be automatically canceled due to those errors.

What Good Smile Company customers should do now

Good Smile Company said it would email all members, including former members who closed their accounts following the incident. It also plans to notify potentially affected customers individually as its investigation progresses.

Although the company has not confirmed that exposed information has been used for phishing or financial fraud, customer contact details and order histories could help criminals create convincing fraudulent messages.

An attacker could reference a legitimate purchase, shipping destination, or payment method to persuade a customer to disclose additional information.

Customers should consider the following precautions:

• Verify breach notifications independently. Visit Good Smile Company's official support website directly rather than following links in emails or text messages.
• Watch for fake delivery and payment requests. Be suspicious of messages claiming that an order requires immediate payment, account verification, or updated card information.
• Review payment activity. Monitor statements for unfamiliar transactions and contact the card issuer if suspicious charges appear.
• Protect your accounts. Although passwords have not been identified as exposed, use unique passwords for your accounts and enable multifactor authentication where supported. Be wary of unsolicited password-reset requests.
• Keep preorder records. Save confirmation emails and transaction details while the online store remains unavailable.

Customers who want to close their Good Smile Company accounts can submit a request via the company's official support form, which operates independently of the affected online store.

For additional context on customer account security, eSecurity Planet's coverage of the Capcom data breach affecting 11.7 million records examines another incident involving a major Japanese entertainment company.

Those concerned about identity-related risks can also review eSecurity Planet's reporting on the IDScan breach involving 13 million people, which highlights the potential consequences of exposed personal information.

Why the breach matters for Good Smile Company customers

Good Smile Company said full payment card numbers and security codes were not among the information that was potentially viewed. However, exposed contact details and purchase histories could still help criminals craft convincing phishing messages or fraudulent payment requests.

For collectors, a fraudulent message referencing a delayed Nendoroid preorder or failed payment could appear credible, especially if it includes accurate details from an earlier transaction. That possibility does not mean such scams have occurred, but it illustrates why exposed shopping records can create security risks.

Customers should verify unexpected communications about orders, refunds, and account restoration through official channels rather than responding directly. Anyone receiving a suspicious payment request should contact Good Smile Company directly before sharing any financial information.

The investigation remains ongoing, and Good Smile Company has not announced when its online store will reopen. Until more details emerge, customers should monitor their accounts, retain purchase records, and rely on verified company updates before taking action on payment or account-related requests.

For another recent breach involving exposed customer information, read how the Zeabur breach affected 321,810 accounts and what customers should do to protect themselves.