Enjoying this article? Add us as a preferred source on Google.
Good Smile Company published a third report on the unauthorized access to its official online shop on October 29, 2026. It has newly come to light that a malicious program was installed on the credit card payment page from 1:55 p.m. on October 21 until 7 a.m. on October 23, and for the 2,800 people who may have entered card details during that window, the name on the card, all 16 digits of the card number, the expiration date and the security code (CVV) may all have leaked. Separately, for members who have ever saved a card to the shop, the number of cards whose last four digits and expiration date are affected comes to 402,466 once duplicates are removed.
Through the second report, the explanation was that “the full number, the cardholder name and the security code are not included.” That has now been overturned. The malicious program was discovered just after 6:30 p.m. on October 28, and individual emails went out to the affected customers in the early hours of October 29.
This article walks through what changed from the second report, the breakdown of those 2,800 people, what the figures of 402,466 cards and 7,673 customers mean, the cause and the response, and what affected customers should do today, all following the official announcement. In our October 27 article we wrote that “the direct risk of a card being used is small.” For those 2,800 people, that premise no longer holds. Correction first, then the rewrite.
As someone who has gone in for the official shop’s limited bonuses, I never expected a day where checking my inbox first thing in the morning felt like this.
Let’s start with exactly what changed.
What changed in the third report compared with the second?
The biggest change is that an incident previously limited to unauthorized viewing now also includes “a malicious program installed on the payment page.” Viewing cannot expose a full card number or a security code, because neither is stored. A program planted in the input screen, by contrast, siphons off whatever is typed into it. That is why the nature of the damage has changed.
| Item | Through the second report (October 26) | Third report (October 29) |
|---|---|---|
| Unauthorized access window | Just after 3 p.m. on October 19 to around 10 p.m. on October 22 | Just after 3 p.m. on October 19 to shortly before 11 p.m. on October 22 |
| Method | Unauthorized viewing of member and order information | Viewing plus a malicious program installed on the payment page from 1:55 p.m. October 21 to 7 a.m. October 23 |
| Card information | Brand, last four digits and expiration date only. Full number, name and security code not included | For 2,800 people, the name, all 16 digits, expiration date and security code are in scope. For 402,466 saved cards, the last four digits and expiration date |
| Order information | No figure published | Orders from 7,673 customers placed between shortly before 10:20 p.m. and shortly before 11 p.m. on October 22 were in a viewable state. 202 orders were actually viewed |
| Cause | A system vulnerability | A system vulnerability was exploited to illegitimately obtain administrator privileges. Not the recently reported PHP vulnerability |
Through this series of unauthorized accesses, customer information recorded on this site was viewed multiple times, and it has further come to light that a malicious program was installed on the credit card payment page between 1:55 p.m. on the 21st and 7 a.m. on the 23rd of the same month. The information regarding the installation of this malicious program came to light at approximately just after 6:30 p.m. on October 28.
Source:Good Smile Company Customer Support
The site was taken offline at 7 a.m. on the 23rd, and the malicious program was found on the night of the 28th. That is five and a half days from shutdown to discovery. Tampering with a payment page is not visible from the mere fact of an intrusion, so in terms of the order investigations run in, that gap is partly unavoidable. But given that information the second report flatly declared “not included” was overturned three days later, members need to reset whatever they did on the basis of that second report.
Who are the 2,800 people whose full card details may have leaked?
They are the 2,800 people who may have entered credit card information on the official shop’s payment page between 1:55 p.m. on October 21 and 7 a.m. on October 23, 2026. Those customers were contacted individually by email in the early hours of October 29.
| Category | Description | People |
|---|---|---|
| 1 | Completed an order paying by credit card | 384 |
| 2 | Attempted a credit card payment that did not complete | Cannot be identified |
| 3 | Logged in and added items to the cart but did not proceed to payment | Cannot be identified |
| 4 | Changed the card on file for a pre-order after placing it | 185 |
| Uncategorized | Attempted to change card details after ordering but did not complete it | Cannot be identified, not contacted |
Group 3 entered no card information, so the company’s view is that no leak occurred there. Because the system does not retain a record of these actions, however, it cannot separate group 2 from group 3, and so it has emailed everyone who might be affected. Read the figure of 2,800 as the ceiling on “people who might have typed their details in,” not as a count of people who did.
The problem sits in the last row of that table. Anyone who started changing their card details after ordering and then abandoned the process may well have passed through the input screen, yet they cannot be identified and no email reaches them. If you have any memory of opening that change screen during this window, you should take the same steps as the confirmed group even though nobody contacted you.
What do the figures of 402,466 and 7,673 refer to?
402,466 is the number of cards, duplicates removed, belonging to members who have saved card details to the official shop and whose last four digits and expiration date may have been viewed. The number of members this covers is still being confirmed. Cardholder names and security codes are not included, and the linked member information did not leak.
7,673 is the number of members who placed orders during the roughly 40 minutes between shortly before 10:20 p.m. and shortly before 11 p.m. on October 22. Only 202 orders were actually viewed without authorization, but because the company cannot identify which 202 they were, it is treating every order from that window as affected. The information that may have been viewed covers the name, address and phone number for both delivery and billing, the email address, the order contents, the amount and the payment method.
| Type | Who is affected | Information that may have leaked |
|---|---|---|
| All card details | The 2,800 people who may have entered details on the payment page | Cardholder name, all 16 digits of the number, expiration date, security code |
| Partial card details | Members who have saved a card (402,466 cards) | Last four digits, expiration date |
| Order information | The 7,673 customers who ordered between shortly before 10:20 p.m. and shortly before 11 p.m. on October 22 | Name, address, phone number, email address, order contents, amount, payment method |
The last four digits and an expiration date cannot be used to make a payment. Combine them with a product name, an amount and an address, though, and you can build a “delivery confirmation” or a “please update your card” message that looks indistinguishable from the real thing. The scam-email concern we raised in our October 27 article is unchanged by this third report.
What was the cause, how is the company responding, and when does the shop reopen?
The cause was a vulnerability in part of the system, which the company says it understands was exploited to illegitimately obtain administrator privileges. It has patched the vulnerability using separately stored source code for its management system, and invalidated and reissued the full set of connection credentials between systems. As of October 29, 2026 there is no date for reopening, and the company says it will announce one once it can confirm the system is safe.
Please note that the vulnerability believed to be the cause is not the recently reported PHP vulnerability.
Source:Good Smile Company Customer Support
The reason the company went out of its way to rule out PHP is presumably that vulnerabilities in PHP itself were widely reported in late October, and people were suspecting a link. Having ruled it out, the natural reading is that this was a hole specific to the application. The report to the Personal Information Protection Commission is done, while reports to the credit card companies and the payment processor are still to come. Once the card companies have been notified, fraud monitoring kicks in on the affected cards.
What should affected customers do today?
The 2,800 people who received an individual email should check their card statement today and, if there is a charge they do not recognize, call the issuer listed on the back of the card. Even with nothing unusual on the statement, now that the full number and the security code are in scope, the realistic move is to talk to your issuer about having the card reissued.
- Check whether the email sent in the early hours of October 29 reached you, including your spam folder
- Review your card statement and contact the issuer about any charge you do not recognize
- Even with no suspicious charges, explain the situation to your issuer and ask about a reissue
- If you remember abandoning a card-details change between October 21 and 23, take the same steps even without an email
- Do not open links in emails, calls or texts claiming to be from Good Smile Company, a public agency or a financial institution
Nothing has changed about how orders are being handled. Orders due to ship in October and pre-ordered items will go out in sequence, and an order is not automatically canceled if you receive a payment error notice. Anyone who cannot complete a new payment, or who wants to close their account, needs to go through the official inquiry form individually. That form runs on a separate system from the online shop.
Enjoying this article? Add us as a preferred source on Google.
Summary. What the third report revealed, and what to do
With the third report, the unauthorized access to Good Smile Company’s official shop went from an incident of “viewing” to one that includes “a malicious program installed on the payment page.” For the 2,800 people who may have entered card details between 1:55 p.m. on October 21 and 7 a.m. on October 23, the cardholder name, all 16 digits, the expiration date and the security code are in scope. For 402,466 saved cards, the last four digits and expiration date may have been viewed, and for orders from 7,673 customers on the night of October 22, names, addresses, order contents and more. The cause was administrator privileges illegitimately obtained through a vulnerability, and it is not the PHP vulnerability. As of October 29, 2026 there is no reopening date.
A third report that overturns the second report’s “the full number and security code are not included” within three days is heavy news for members. That said, sending individual emails within 12 hours of discovering the malicious program, and calling out to people in the categories it cannot identify with a “if this sounds like you” notice, deserves credit. On the member side, drop whatever reassurance the second report gave you, and do the statement check and the call to your card company today. That stops most of the potential damage.
Don’t relax just because no email arrived. If you remember opening that card-change screen, you are affected too.
Leave a Reply