October 23, 2026 — First Notice
October 26, 2026 — Second Notice (Additions to the First Notice)
October 29, 2026 — Third Notice
To Our Customers
Further to our notice dated 23rd October 2026 regarding the possible exposure of customer information due to unauthorized access to the Good Smile Company Online Store (hereinafter referred to as “the Website”), we are providing the following update on facts established through our subsequent investigation and the status of our response.
Please note that some of the information provided in our first and second notices has changed.
We deeply apologize for the changes to our initial announcement and for the significant inconvenience and concern this has caused our customers.
Customers newly identified as affected by this issue were contacted by email early this morning. We also apologize for the concern caused by the time it took between sending those emails and posting this notice.
1 Overview
Shortly after 6:00 a.m. JST on 23rd October 2026, we were notified by the service provider responsible for developing and maintaining the Website’s system that an unauthorized third party had accessed the Website between shortly after 3:00 p.m. JST on 19th October 2026 and shortly before 11:00 p.m. JST on 22nd October 2026. We shut down the Website at 7:00 a.m. JST on 23rd October 2026. We have established that, during this series of unauthorized accesses, customer information recorded on the Website was viewed on multiple occasions and that a malicious program was present on the credit card payment page from 1:55 p.m. JST on 21st October 2026 to 7:00 a.m. JST on 23rd October 2026.
The information concerning the installation of this malicious program came to light shortly after 6:30 p.m. JST on 28th October 2026.
2 Status of the Exposure of Customer Information
(1) Cause
We understand that a vulnerability in part of the system used by the Website was exploited to obtain administrator privileges without authorization.
(2) Customers Whose Credit Card Information May Have Been Exposed
2,800 customers who may have entered their credit card information on the Website’s credit card payment page between 1:55 p.m. JST on 21st October 2026, and 7:00 a.m. JST on 23rd October 2026 may be affected by this issue. The information that may have been exposed is as follows:
• Cardholder’s name
• Card number (all 16 digits)
• Expiration date
• Security code
We have contacted the affected customers separately by email.
The 2,800 customers above include customers who performed any of the following actions on the Website’s credit card payment page during the affected period:
(i) 384 customers who placed orders using credit card payment
(ii) Customers who attempted to pay by credit card but did not complete payment
(iii) Customers who logged in to the Website and added products to their carts but did not proceed to checkout
(iv) 185 customers who completed the procedure to change credit card information used for payment after placing a preorder
The Website’s system does not retain records of these actions, so we cannot determine whether customers in groups (ii) and (iii) belong to one group or the other.
We believe that the credit card information of customers in group (iii) was not exposed. However, we have contacted all customers who may fall into any of groups (i), (ii), (iii), and (iv) individually.
In addition to groups (i) through (iv), credit card information may also have been exposed for customers who attempted to change the credit card information used for payment after placing an order but did not complete the procedure. However, because the Website’s system does not retain records of these actions, we cannot identify those customers. If this applies to you, please review the precautions in Section 4 below.
(3) Customers Whose Partial Credit Card Information May Have Been Exposed
Customers who have previously registered credit card information on the Website may be affected by this issue. The information that may have been exposed is as follows:
• Last four digits of the card number
• Expiration date
No exposure of cardholders’ names or security codes has been confirmed. No registered member information linked to the above potentially exposed information was exposed. We are still confirming the number of customers in this category. However, the number of credit cards whose information may have been exposed in this category is 402,466, excluding duplicates.
(4) Customers Whose Order Information May Have Been Exposed
7,673 customers who placed orders between shortly before 10:20 p.m. JST and shortly before 11:00 p.m. JST on 22nd October 2026 may be affected by this issue.
The information that may have been exposed is as follows:
• Shipping and/or billing name
• Shipping and/or billing address
• Shipping and/or billing telephone number
• Email address
• Order details
• Order Amount
• Payment method
Information relating to 202 orders was viewed without authorization. However, because the Website’s system does not allow us to fully identify which order information was viewed, we consider all customers associated with the 7,673 orders that may have been viewed to be potentially affected.
3 Response Status and Measures to Prevent Recurrence
Using a separately stored copy of the source code for the Website’s administration system, we remediated the vulnerability believed to be the cause. To minimize risk, we invalidated and updated all connection information between the individual systems that make up that system and implemented other necessary security enhancements.
The vulnerability believed to be the cause of this issue differs from the recently reported PHP vulnerability.
We have already contacted customers whose full credit card information may have been exposed individually by email.
Among the relevant authorities and organizations, we have reported this incident to Japan’s Personal Information Protection Commission. We will proceed with reporting to credit card issuers and payment processing providers.
We will provide a further announcement regarding when the Website will reopen once its security has been verified. We once again apologize for the significant inconvenience, anxiety, and disruption this has caused our customers.
4 Request for Your Cooperation in Preventing Further Harm
The exposed information may be misused in fraudulent or impersonation attempts through suspicious emails, telephone calls, or SMS messages purporting to be from the Company, public authorities, financial institutions, or other organizations. Please do not respond to such communications from unfamiliar senders or callers, and do not click any links they may contain.
If you have received an individual email from us regarding the exposure of your credit card information, please check your transaction history for any transactions you do not recognize. If you find any such transactions, please promptly contact your credit card issuer using the contact details on the back of your card. We once again apologize for the inconvenience and disruption this has caused.
5 Contact for Inquiries Regarding This Incident
If you have any inquiries regarding this incident, please contact our Customer Support team below.
Good Smile Company Customer Support
Inquiry Form
https://support.goodsmile.com/hc/en-us/requests/new?ticket_form_id=48452039907097
Note: The inquiry form operates on a separate system from the Website.
6 Additional Information
- Product shipments
Although the Website is currently temporarily closed for maintenance, we are continuing to process and dispatch existing orders and preorders scheduled for shipment in October on a rolling basis. - Payment errors for pre-orders (credit card and PayPal)
If you have received an automated payment error notification and are unable to retry payment because the Website is temporarily closed, please contact us using the inquiry form below. Please rest assured that your order will not be automatically canceled. -
Requests to close membership accounts while the Website is temporarily closed
We can continue to process requests to close membership accounts as usual. Please submit your request using the inquiry form below, and we will handle it individually.Good Smile Company Customer Support
Inquiry Form
https://support.goodsmile.com/hc/en-us/requests/new?ticket_form_id=48452039907097
Note: The inquiry form operates on a separate system from the Website.
Good Smile Company, Inc.