# Good Smile Company: official online shop breached, member details and partial card data possibly viewed · pwn.watch

> Good Smile Company, the Japanese figure maker, says a third party accessed its official online shop between about 3pm on Oct 19 and 10pm on Oct 22 2026 (JST), and members' names, addresses, phone numbers, order details and card last four digits and expiry dates may have been viewed. The shop was closed while the vulnerability is fixed. Customers are warned about phishing emails, calls and SMS.

Page: https://pwn.watch/i/good-smile-company-online-shop-breach-oct-2026 · generated 2026-10-24T08:44:16.553Z

## Status
- Severity: medium · status: live · patch: no-fix-needed
- Product: Good Smile Company official online shop
- Started: 2026-10-19
- Affected: Good Smile Company online shop members

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/good-smile-company-online-shop-breach-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/good-smile-company-online-shop-breach-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/good-smile-company-online-shop-breach-oct-2026.json
- This file: https://pwn.watch/i/good-smile-company-online-shop-breach-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-23: Good Smile discloses the incident and closes the shop to fix the vulnerability. (https://www.gamespark.jp/article/2026/10/23/174018.html)
- 2026-10-19: Unauthorized access to the official shop begins (about 3pm JST) and continues until about 10pm on Oct 22. (https://support.goodsmile.com/hc/en-us/articles/63547468806297-Notice-of-Possible-Exposure-of-Customer-Information-Due-to-Unauthorized-Access)

## Fix brief
# Security brief: Good Smile Company: official online shop breached, member details and partial card data possibly viewed

Source: https://pwn.watch/i/good-smile-company-online-shop-breach-oct-2026 · status: live · severity: medium · updated Oct 24, 2026, 06:40 UTC

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Good Smile Company, the Japanese figure maker, says a third party accessed its official online shop between about 3pm on Oct 19 and 10pm on Oct 22 2026 (JST), and members' names, addresses, phone numbers, order details and card last four digits and expiry dates may have been viewed. The shop was closed while the vulnerability is fixed. Customers are warned about phishing emails, calls and SMS.

Severity detail: Personal data and partial card data (last 4 + expiry) possibly viewed; count not disclosed

- Product: Good Smile Company official online shop

## Affected versions
- Good Smile Company online shop members

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Latest updates
- Oct 23, 2026: Good Smile discloses the incident and closes the shop to fix the vulnerability.
- Oct 19, 2026: Unauthorized access to the official shop begins (about 3pm JST) and continues until about 10pm on Oct 22.

## Advisories
- [Notice of Possible Exposure of Customer Information Due to Unauthorized Access](https://support.goodsmile.com/hc/en-us/articles/63547468806297-Notice-of-Possible-Exposure-of-Customer-Information-Due-to-Unauthorized-Access) (Good Smile Company)

## Write-ups & news
- [グッドスマイルカンパニー、公式ショップ不正アクセス発生により会員情報流出の可能性](https://www.gamespark.jp/article/2026/10/23/174018.html)
- [グッスマ公式ショップへの不正アクセスが判明](https://dengekionline.com/article/202610/91935)

---
Machine-readable: https://pwn.watch/i/good-smile-company-online-shop-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.