Good Smile Company announced on October 29 that it confirmed malicious software was installed on the payment page of its official online shop. The company has individually notified 2,800 customers who may have entered their credit card information during that period regarding potential data exposure.
According to the third update released on October 29, the malware was installed on the payment page from 1:55 p.m. on October 21 to 7:00 a.m. on October 23. Information that may have been compromised through this route includes cardholder names, full 16-digit card numbers, expiration dates, and security codes. The company explained that after initial unauthorized access occurred between October 19 and 22, it shut down the store at 7:00 a.m. on October 23, and discovered the presence of the malware around 6:30 p.m. on October 28.
The 2,800 individuals subject to individual notifications include 384 customers who completed card payments and 185 who updated payment cards after pre-ordering, as well as users who abandoned checkout or merely added items to their shopping carts. The company noted that while an actual card data leak likely did not occur for users who only used shopping carts, they were notified together because system logs could not distinguish them from users with uncompleted checkouts.
A separate investigation is underway regarding saved card information previously registered to account profiles. In this category, the last four digits of card numbers and expiration dates may have been exposed, affecting 402,466 unique cards. The company stated that while the exact number of affected customers is still being confirmed, no breach of cardholder names, security codes, or linked member profile information has been confirmed.
Indications of unauthorized viewing of order information were also uncovered. Between approximately 10:20 p.m. and 11:00 p.m. on October 22, 202 order records were viewed. Because the company cannot pinpoint which specific records were viewed, it has classified 7,673 associated customers as potentially affected and is notifying them accordingly.
Good Smile Company plans to announce the re-opening date of its official online shop at a later date once vulnerability fixes and connection credential updates are complete and security is assured. Furthermore, following its report to the Personal Information Protection Commission, the company plans to report the incident to credit card companies and payment gateways, urging notified users to check their card statements and contact their card issuer if any fraudulent transactions are found.
