Breach · · 3 min read
Good Smile Company’s online store: member and order details viewed
The figure maker says someone repeatedly viewed member names, addresses, orders and partial card details on its Japanese online store between October 19 and 22.
Good Smile Company, the Tokyo-based maker of Nendoroid and other collectible figures, has shut its online store after finding that someone viewed members’ personal and order information without permission. If you’ve ever had an account on the Good Smile Company Online Store, here’s what the company has said so far.
What happened
In its notice, first posted October 23 and updated October 26, Good Smile says system logs show the store’s administration system was accessed and viewed several times between shortly after 3:00 p.m. JST on October 19 and about 10:00 p.m. JST on October 22, 2026. The company learned about it on the morning of October 23, when the firm that develops and maintains the site told it.
The information that may have been viewed:
- Basic details: name (and its phonetic spelling), gender, address, phone number and email address
- Order details: order date, product, quantity, amount, shipping address, recipient name and phone number if different, payment method and payment status
- Card details: card brand, the last four digits and the expiry date
Good Smile says the full card number, the cardholder name and the security code were not included, and that card details for orders paid through outside services such as Amazon Pay or PayPal were never stored on its servers. It says Good Smile Company US, its European and UK shops, Nendoroid Face Maker and its Rakuten store run on separate systems and weren’t affected.
The cause is still under investigation. So far the company says a vulnerability was exploited, and that it was not the PHP flaw reported around the same time. It has reported the incident to Japan’s Personal Information Protection Commission and plans to email every member, including people who have closed their accounts.
What this means for you
Last four digits, expiry date and an order history can’t be used to make a purchase on their own. They are, though, exactly what a fake “Good Smile support” email needs to sound real: it can quote your last order and the end of your card number.
What you can do
- Be suspicious of order or refund messages. Good Smile warns about fake emails, calls and texts claiming to be from it, a public body or a bank. Don’t click links in them.
- Contact Good Smile only through its support site, which it says runs on a separate system from the store.
- Watch your card statements. If anything looks off, call the number on the back of your card.
- If you reused your store password elsewhere, change it there. Passwords aren’t on the list, but it’s a cheap precaution.
How Frame helps
When you add a breach like this to a verified email in Frame, you see what it exposed, get a short checklist and see it counted in your exposure report. Automatic breach lookups aren’t live yet. Frame’s email aliases also let you give each shop its own address, so a leak at one store doesn’t lead scammers straight to your main inbox.
Sources
- Good Smile Company, Notice of Possible Exposure of Customer Information Due to Unauthorized Access (Updated October 26, 2026), October 23 and 26, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.