This article provides answers to frequently asked questions for customers in Group B.
Applicable to: Customers who meet one or more of conditions ① to ④ listed below
Affected period: 1:55 p.m. JST on 21st October 2026, to 7:00 a.m. JST on 23rd October 2026
Customers who entered credit card information on the payment page of the Good Smile Company Online Store during the affected period. Specifically, customers who fall into any of categories ① to ④ below.
① Customers who completed an order using credit card payment
② Customers who attempted to pay by credit card and entered their credit card information but did not complete an order
③ Customers who logged in and added products to their carts but did not proceed to checkout (*1)
④ Customers who completed the procedure to change credit card information used for payment for an existing preorder (including those who attempted the change but did not complete it)
*1 Customers in category ③ (“customers who logged in and added products to their carts but did not proceed to checkout”) did not have their full credit card information exposed. However, because the Website’s system cannot distinguish them from customers in category ②, we have sent individual emails about the possible exposure of full credit card information. Please see Question 4 below for details.
Information that may have been exposed
- Cardholder’s name
- Card number (all 16 digits)
- Expiration date
- Security code
How to check whether you are affected
We have contacted the affected customers (2,800) individually at their registered email addresses. Please check whether you have received an email with either of the following subject lines.
Email subject lines:
- [Important] Possible Exposure of Credit Card Information Due to Unauthorized Access to Our Online Store and Request for Action
- [Important] Notice and Apology Regarding Possible Exposure of Order Information Due to Unauthorized Access to Our Online Store
FAQ
1. What is the affected period?
Customers who entered credit card information on the payment page of the Good Smile Company Online Store between 1:55 p.m. JST on 21st October 2026, and 7:00 a.m. JST on 23rd October 2026, are within the scope of this exposure resulting from unauthorized access.
2. Why was credit card information exposed?
A vulnerability in part of the system used by the Good Smile Company Online Store was exploited, and a malicious program was installed on the payment page.
3. Was the information exposed because Good Smile Company stored credit card information?
The only credit card details stored in the Good Smile Company Online Store’s system were the last four digits of card numbers and expiration dates. We did not store other credit card information, including full 16-digit card numbers, cardholders’ names, or security codes.
We understand that the exposure resulted from a malicious program installed on the payment page through unauthorized access to the Good Smile Company Online Store, which intercepted information customers entered on that page.
4. I only added products to my cart and did not proceed to checkout, but I received an email about possible information exposure. Was my credit card information also exposed?
Credit card information was not exposed for customers who did not enter it on the store’s payment page during the affected period.
Because the system cannot distinguish customers who attempted but did not complete payment from those who added products to their carts but did not proceed to payment, we have also sent individual notifications to customers who may fall into the affected group. We apologize for the concern caused by this unexpected notification.
5. I received an email about possible information exposure. What should I do first?
Please check your credit card statements or online statements for any transactions you do not recognize. If you find any suspicious charges or unfamiliar transactions, please promptly contact your card issuer using the contact details on the back of your card.
We regret the significant inconvenience, but also ask that you consider having your credit card reissued.
6. Will you provide compensation?
We understand that, in general, losses resulting from unauthorized credit card use are handled in accordance with the credit card issuer’s compensation policies and fraud detection systems.
If you identify any charges you do not recognize, please promptly contact your card issuer for assistance.
We are requesting that credit card issuers ensure that customers do not have to bear any card reissuance fees.
7. What should I do if I want my credit card reissued?
If you would like your card reissued, please contact your card issuer directly using the contact details on the back of your card.
We are requesting that credit card issuers ensure that customers do not have to bear any card reissuance fees.
8. Since the exposure was caused by your company, I would like you to arrange for my credit card to be reissued.
We sincerely apologize for the inconvenience and burden this has caused you. Under credit card agreements and account management terms, third parties, including the Company, generally cannot request card reissuance on behalf of the cardholder.
We regret the inconvenience, but ask that you contact your card issuer using the contact details on the back of your card to arrange or discuss reissuance yourself.