Enjoying this article? Add us as a preferred source on Google.
The Good Smile Company Official Shop was hit by unauthorized access from a third party, and members’ personal data was viewed without permission. The access window ran from just after 3 PM on October 19, 2026 to around 10 PM on October 22, and the data covered names, addresses, phone numbers, email addresses, order details, and the brand, last four digits and expiration dates of credit cards. The company shut the shop down as soon as it found out, published a first report on its official X account on October 23, and reported the incident to the Personal Information Protection Commission. As of October 27, 2026 there is no date for the shop reopening.
Full card numbers, cardholder names and security codes were not included. That means the direct risk of someone running up charges on your card is small. What should worry you is an email from someone who already knows the name of the product you ordered, the amount you paid and the last four digits of your card, saying “please confirm your delivery” or “please update your card details.” Everything needed to build a scam email that looks completely genuine walked out the door together.
From October 26 onward, members have started receiving notices by email. The address our editorial team uses as a member received one too, carrying the disclaimer that “this message is being sent even to customers who have opted out of our newsletter.” This article breaks down what was viewed, what was not, what members should do right now, and what happens to orders already placed, drawing on the official statements and the reporting around them.
Start with what was actually seen.
What Data Was Viewed at the Good Smile Company Official Shop?
Three sets of data may have been viewed: members’ basic information, their order information, and part of their credit card information. The company says it believes the unauthorized access exploited a vulnerability in its system, and that the fix has already been applied. The number of affected members has not been disclosed.
| Category | Items that may have been viewed |
|---|---|
| Member basic information | Name, phonetic reading of the name, gender, address, phone number, email address |
| Order information | Order date, product name, quantity, amount, payment method, payment status, shipping address |
| Credit card | Brand, last four digits of the number, expiration date |
On the other side, the company spelled out what was not included.
Cardholder names, the digits of the card number other than the last four, and security codes were not included
Source:Good Smile Company Official Shop Support
Since the full card number and the security code needed to actually process a payment did not get out, nobody can go shopping with this data alone. The problem is the combination. When an email arrives saying “the payment for the Nendoroid you ordered in October did not go through on the card ending in xxxx,” can you tell that it is fake? If the order details and the last four digits line up, most people will believe it. The most realistic harm from this leak is exactly that kind of impersonation.
How Did Events Unfold From the Breach to the Member Emails?
The intrusion spanned roughly three and a half days, from just after 3 PM on October 19 to around 10 PM on October 22, and log analysis confirmed multiple separate accesses. The shop was closed as soon as the company became aware, a first report went up on its official X account on the 23rd, and the incident was reported to the Personal Information Protection Commission the same day. The company then continued investigating alongside its development partner, added the scope and response plan to its notice, and began emailing members from the 26th.
| Date and time | What happened |
|---|---|
| October 19, 2026, just after 3 PM | Unauthorized access begins (confirmed through log analysis) |
| October 22, 2026, around 10 PM | Last confirmed unauthorized access. Shop closed as soon as the company became aware |
| October 23, 2026 | First report on the official X account. Incident reported to the Personal Information Protection Commission |
| October 23 to 26 | Investigation continues with the development partner. Scope and response plan added to the notice |
| October 26 onward | Members notified by email, including those who had unsubscribed |
| Reopening | Undecided (as of October 27, 2026) |
The member email reads, “On Friday, October 23, 2026 we announced a first report on social media regarding the possibility of unauthorized access to this site, and we once again offer our sincere apologies for the delay in contacting members directly by email.” Do the math and it took more than three days for a member who does not follow X to learn anything. The first report on social media came fast, but the company itself is apologizing for how late the email was.
October has produced a steady run of unauthorized access reports across the games and hobby industries. GEO Online confirmed an incident on the 15th and took everything offline on the 17th, there were unauthorized logins to Square Enix Accounts, and more than 11.77 million records leaked from CAPCOM ID. The methods and the scale differ in each case, but the common thread is that member data on e-commerce sites is what attackers are going after.
What Should Good Smile Company Official Shop Members Do Now?
The top priority is to distrust any email, text message or phone call claiming to come from the official shop or from Good Smile Company. The company is likewise asking people not to engage with suspicious contact and not to open any links included in it. Passwords were not listed among the data viewed, but anyone reusing the same password on other services should change it.
- Do not open links in emails claiming to be from Good Smile Company. Do not trust them even if the order details and last four digits match. Verify directly through the official support site
- Check your credit card statement. If there is a charge you do not recognize, contact your card issuer
- For any email asking you to “update your card details,” reporting a “payment error” or requesting “delivery confirmation,” never act through the link in the message, genuine or not
- If you use the same password on the official shop and on other services, change it
- Hold on to your old order confirmation emails. They are what you will use to cross-check your order status once the shop is back
Whether to cancel your card is a call you can make knowing that the last four digits and an expiration date alone cannot complete a payment. That said, if even one suspicious charge shows up on your statement, kill the card without hesitating. Between the hassle of a reissue and leaving an unexplained charge alone, the second one costs you more.
What Happens to Existing Orders and the Official Shop Reopening?
As of October 27, 2026 there is no official guidance on blanket cancellation of existing orders or on delayed shipping. The reopening date is described as, “we are still not in a position to provide an estimate for when this work will be complete.” Are the orders still alive, and when will payments be charged? The part members most want to know is still blank.
| Item | As of October 27, 2026 |
|---|---|
| Official shop | Closed |
| Reopening date | Undecided |
| Handling of existing orders | No official guidance (no announcement of blanket cancellation or delay either) |
| Contact with affected members | Individual emails to follow once confirmed |
| Number of people affected | Not disclosed |
| Cause | A system vulnerability, which the company says has been fixed |
With Nendoroid, figma and POP UP PARADE preorders, waiting months for release is simply how it works, and plenty of people ordered specifically for an official shop exclusive bonus. Whether those orders survive the reopening, and whether the payment timing shifts, matters to members just as much as the leak itself. Keep the order confirmation emails sitting in your inbox and wait for word on the reopening. As a guy who paints everything himself, Good Smile’s finished figures honestly do not come up much for me, but having reached for an official shop exclusive bonus, I can hardly call this somebody else’s problem.
Enjoying this article? Add us as a preferred source on Google.
Summary: What We Know About the Good Smile Company Official Shop Breach
The Good Smile Company Official Shop was subjected to unauthorized access by a third party from just after 3 PM on October 19, 2026 to around 10 PM on October 22, and members’ names, addresses, phone numbers and email addresses, their order information, and the brand, last four digits and expiration dates of their credit cards may have been viewed. Full card numbers, cardholder names and security codes were not included. The shop is closed with no reopening date, the number of people affected has not been disclosed, and the incident was reported to the Personal Information Protection Commission on October 23. Members should distrust emails and calls claiming to be official, check their card statements, and change any reused passwords. Guidance on existing orders is still pending (as of October 27, 2026).
The data that would let someone use your card directly did not get out. What did get out, as a complete set, is the raw material for looking authentic: your order details and the last four digits. For a while now, the more polite an email claiming to be from Good Smile looks, the more you should doubt it. What I want from the company’s next statement is not the reopening date but whether existing orders are still standing.
Doubt the emails, read your statement, keep the order confirmations. Those three cover it.
Read Next
Snicker Kitamura
Leave a Reply