Good Smile Company Shop Hit by Unauthorized Access, Member Data Possibly Viewed
The breach exposed order and delivery records rather than just account logins, which is the kind of data that makes the follow-up scam warnings about fake emails and SMS worth taking seriously.
Reporting from 1 source: Denfaminicogamer.
Good Smile Company reported on October 23 that a third party accessed the administrative side of its Official Shop multiple times between shortly after 15:00 on October 19 and around 22:00 on October 22. Names, addresses, phone numbers, email addresses and order details for members may have been viewed. The site has been closed for maintenance with no reopening date. The company fixed the vulnerability it believes was the cause and reported the matter to the Personal Information Protection Commission.
Good Smile Company says the intrusion ran for roughly three days before it was caught. According to its log analysis, unauthorized access to the shop's administrative information happened repeatedly from shortly after 15:00 on October 19 to around 22:00 on October 22. The site has stayed closed for maintenance since the access was found, and the company has not given a reopening date.
The exposed data covers member basics (name and phonetic reading, gender, address, phone, email) plus order records: order date, product name, quantity, amount, delivery address and recipient phone, payment method and payment status. For card payments, the card brand, last four digits and expiration date are in scope. The cardholder name, the full card number and the security code are not.
Good Smile says it has fixed the vulnerability it believes was the cause and strengthened system security, and it reported the matter to the Personal Information Protection Commission on October 23. Members who may be affected will be contacted individually by email once confirmation is complete. The company also warns that the data could be used for fraud or impersonation through emails, calls or SMS claiming to come from the company, public institutions or financial institutions, and asks people not to respond or click links from unfamiliar senders.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.