Good Smile Company Breach May Expose Cards of 2,800 Users

Good Smile Company has confirmed that credit card details entered by up to 2,800 customers on its official online shop may have been stolen. In its third update on the incident, the company said a malicious program was planted on the card payment page.

What happened

A third party gained unauthorized access between October 19 and 22 and viewed user information several times. From 13:55 on October 21 until the site was closed at 07:00 on October 23, the malicious program sat on the checkout page. The company only discovered it on October 28. The shop has been offline since October 23.

The company says it has fixed the vulnerability behind the intrusion, which it says was not in PHP, and has strengthened security. It has reported the case to Japan's Personal Information Protection Commission and will now notify card companies and payment processors. No reopening date has been given.

Who is affected

For the up to 2,800 users, the data at risk is the cardholder name, the full 16-digit card number, the expiry date and the security code. Of that group, 384 actually completed an order by card. The rest tried to pay without finishing, logged in and added items to a cart, or changed card details after a reservation (185 users). The company considers leakage unlikely for those who never reached payment, but its system does not log such actions, so it contacted them all individually. Users who tried and failed to change card details after ordering may also be affected.

Separately, the last four digits and expiry dates of up to 402,466 cards registered on the site may have leaked. The company says cardholder names, security codes and linked member data were not exposed.

Order data may also have leaked for up to 7,673 users who ordered between 22:20 and about 23:00 on October 22, although only 202 orders were confirmed as viewed. The data covers delivery or billing name, address, phone number, email, order contents, amount and payment method.