Loja oficial online da Good Smile Company · Breach

Good Smile Company reports possible member data exposure

Oct 18, 2026 · 1 min read

Good Smile Company, the Japanese figure maker, disclosed unauthorized access to its official online shop that may have exposed member information. The company published a notice about the case. Members should watch for suspicious contacts.

By HIFY Radar newsroom Updated 10/26/2026 01:25 PM Get this every day →← Back to the feed 3 sources

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Good Smile Company, a Japanese figure maker, reported unauthorized third-party access to its official online shop. The access occurred between October 19 and 22, 2026, and may have exposed member data. The shop was taken offline after discovery and has no reopening date.

Why it matters

Personal data (name, address, phone, email), order data, and partial credit card data may have been viewed. According to the company, full card numbers and security codes were not exposed. Affected customers may be targeted by phishing via email, phone calls, and SMS.

What to do

Shop members should be wary of contacts impersonating Good Smile Company, public agencies, or banks. The company said it fixed the vulnerability and strengthened security, and will notify affected members by email. Follow the company's official notice.

For the technical team

Affected: Loja oficial online da Good Smile Company · Members of the Good Smile Company official online shop.
Exploitation: Exploitation reported by Good Smile Company itself. The sources cite no actors, public PoC, or widespread exploitation.
Fix: No patched version applies. The company said it fixed the identified vulnerability and strengthened system security. The site remains closed with no reopening date.
Vector: Good Smile Company official online shop (e-commerce site). Unauthorized third-party access through a website vulnerability, details not disclosed. Multiple accesses from after 15:00 on Oct 19, 2026 to around 22:00 on Oct 22, 2026.
More details: Data possibly viewed, per the company: name, name reading, gender, address, phone, email; order data (date, product, quantity, amount, delivery address, name and phone, payment method and status); card data (brand, last 4 digits, expiration). Cardholder name, full card number, and security code were not included. Potentially affected members will be notified individually by email. Customer support runs on a system separate from the shop. Official announcement posted October 23, 2026.