October 23, 2026
Updated October 26, 2026
To Our Customers
Good Smile Company, Inc. (head office: Akiba CO Building, 3-16-12 Sotokanda, Chiyoda-ku, Tokyo; President and Representative Director: Kantaro Iwasa; hereinafter referred to as “we” or “the Company”) has confirmed that an unauthorized third party accessed the Good Smile Company Online Store, the e-commerce website operated by the Company (hereinafter referred to as “the Website”), and viewed personal and other information belonging to registered members of the Website without authorization, as detailed below.
We deeply apologize for the significant inconvenience and burden this has caused our customers and all other parties concerned. We take this incident very seriously and shut down the Website immediately upon discovering the unauthorized access. We are working to determine the cause. We regret that we are not yet able to provide an estimated completion date for this work.
The facts confirmed to date and our planned response are outlined below.
|
Added October 26, 2026 Since our notice of October 23, we have received many inquiries and comments. We once again apologize for the significant anxiety and concern this has caused. While we are continuing to verify the facts, we are providing the following additional information to address the questions and comments we have received as fully as possible. |
1 Overview
Our analysis of system logs has revealed that information in the Website’s administration system was accessed and viewed without authorization on multiple occasions between shortly after 3:00 p.m. JST on October 19, 2026, and approximately 10:00 p.m. JST on October 22, 2026. We are continuing to investigate the details.
|
Added October 26, 2026 We first became aware of the unauthorized access shortly after 6:00 a.m. JST on October 23, when we were notified by the service provider responsible for developing and maintaining the Website’s system. |
2 Personal and Other Information That May Have Been Viewed
- Basic information
Name, phonetic spelling of name, gender, address, telephone number, and email address - Order information
Order date, product name, quantity, amount, shipping address, recipient’s name and telephone number (if separately registered), payment method, and payment status (whether payment has been completed) -
Credit card information
Card brand, last four digits of the card number, and expiration date
Note: The following information is not included: the cardholder’s name, any digits of the card number other than the last four, and the security code.Added October 26, 2026
-
Orders paid for using external payment services such as Amazon Pay or PayPal
Orders placed using external payment services are processed through the respective payment providers’ authentication systems. As we do not store credit card information for these orders on our servers, there is no possibility that such credit card information was viewed or otherwise accessed. -
Other related services, shops and the Rakuten store (GOOD SMILE STORE on Rakuten Ichiba)
Nendoroid Face Maker, Good Smile Company US, Good Smile Company Europe Online Shop, Good Smile Company Europe, Good Smile Company UK, and our Rakuten Ichiba store operate on systems separate from the Website’s system and are therefore unaffected by this unauthorized access.
-
Orders paid for using external payment services such as Amazon Pay or PayPal
3 Cause
The investigation is ongoing. Based on our findings to date, we understand that the unauthorized access resulted from the exploitation of a vulnerability.
|
Added October 26, 2026 The unauthorized access was not caused by a PHP vulnerability. We had already addressed the recently reported PHP vulnerability between October 21 and October 22, 2026. |
4 Response Status and Measures to Prevent Recurrence
- We have strengthened system security, including by remediating the vulnerability identified to date as the suspected cause. We are continuing our investigation and response efforts.
-
In accordance with Japanese law, we reported this incident to Japan’s Personal Information Protection Commission today.
Added October 26, 2026
- We have decided to send individual emails containing the same information as this notice to all members, including former members who have closed their accounts as a result of this incident.
5 Request for Your Cooperation in Preventing Further Harm
The exposed information may be misused in fraudulent or impersonation attempts through suspicious emails, telephone calls, or SMS messages purporting to be from the Company, public authorities, financial institutions, or other organizations. Please do not respond to such communications from unfamiliar senders or callers, and do not click any links they may contain.
6 Contact for Inquiries Regarding This Incident
If you have any inquiries regarding this incident, please contact our Customer Support team below. Once we have completed the relevant checks, we plan to notify potentially affected members individually by email on a rolling basis.
Good Smile Company Customer Support
Inquiry Form
https://support.goodsmile.com/hc/en-us/requests/new?ticket_form_id=48452039907097
Note: The inquiry form operates on a separate system from the Website.
|
Added October 26, 2026
|
Once again, we deeply apologize for the concern this incident has caused our members and all other parties concerned. In light of this incident, we will renew our efforts to ensure thorough security measures and work to prevent recurrence and restore your trust.
Good Smile Company, Inc.
Kantaro Iwasa
President and Representative Director