Good Smile Company released a new update on Thursday about the breach of its online store, and the numbers are worse than the first announcement suggested. Full credit card details for up to 2,800 customers may have been exposed.
The company said a malicious program sat on the site’s credit card payment page from 1:55 p.m. JST on October 21 until 7:00 a.m. JST on October 23. Staff found evidence of the program on October 28 shortly after 6:30 p.m. JST, five days after the window closed.
Those 2,800 customers may have had their cardholder name, complete 16-digit card number, expiration date and security code taken. Good Smile says it has emailed the affected people directly.
The bigger number
Separately, customers who had previously saved a card on the site may have had partial information exposed: the last four digits and the expiration date. The company puts that group at 402,466 cards, excluding duplicates. It says cardholder names and security codes were not exposed in that case, and that no registered member information was linked to the partial data.
Order information was also exposed. Good Smile said 7,673 customers who placed orders on October 22 between roughly 10:20 p.m. and 11:00 p.m. JST may be affected. That data includes shipping and billing names, addresses, phone numbers, email addresses, order contents, order amounts and payment method.
The company stated that information tied to 202 orders was viewed without authorization. Because the system does not let it identify exactly which orders were seen, it is treating all 7,673 as potentially affected.
What the company did
Good Smile took the store offline on October 23 when the breach was discovered. It says it has since removed the vulnerability it believes caused the issue, strengthened system security, and reported the incident to Japan’s Personal Information Protection Commission as Japanese law requires.
One detail stands out. Good Smile said the cause is a different vulnerability from the PHP one it referred to in its first notice about the breach, which means this was not a repeat of a known problem it had already patched. Readers may remember a separate PHP flaw that took down MANGA Plus, K MANGA and Magazine Pocket earlier this year.
Why this matters beyond one company
Good Smile is one of the largest figure makers in the world. It produces Nendoroid, figma and Scale figures, and its store handles orders from collectors across Asia, Europe and North America. A payment-page compromise at that scale reaches people who buy anime merchandise rather than people who follow cybersecurity news, and those two groups overlap less than they should.
The five-day detection gap is the part worth paying attention to. The malicious script ran on the payment page for more than a day and a half, and nobody noticed for five more days after that. For a store that processes card payments constantly, that is a long window.
For anyone who ordered from the store between October 21 and October 23, the practical advice is simple. Check the card statement, and if the card was entered on that page, ask the issuer for a replacement. Partial exposure of a card number and expiry is not enough to charge a card on its own, but it is enough to make a card a target for phishing that quotes real details.
Figure and hobby companies have become bigger targets as their online stores grow, and most of them are not built like payment processors.
Source: Anime News Network
Featured image: the Good Smile Company store image used with the breach report, via Anime News Network.
