Good Smile Company has updated its notice about unauthorised access to its global online store, adding new detail on 26 October while stressing that its investigation is still under way. The company said its store administration system was accessed without authorisation on multiple occasions between 19 and 22 October 2026. The October update does not give a number of affected customers, and no such figure should be added to the story unless the company publishes one.

What may have been viewed

The information that may have been viewed includes names, phonetic spellings of names, gender, addresses, telephone numbers and email addresses, together with order details such as dates, products, quantities, amounts, shipping addresses and payment methods. Limited card information is also involved: the card brand, the last four digits and the expiry date. The company states that full card numbers, security codes and cardholder names recorded as payment information were not included. Orders paid through external services such as Amazon Pay or PayPal are not affected in this respect, it adds, because it does not store card information for those orders on its own servers.

What the update rules out

Two clarifications in the 26 October update matter. First, the company says the unauthorised access was not caused by the recently reported PHP vulnerability, which it had already addressed between 21 and 22 October. Second, it says related services on separate systems, including Good Smile Company US, its European shops and its Rakuten store, are unaffected. The company says it has strengthened security, including remedying the vulnerability identified so far as the suspected cause, and is continuing its investigation. The update sets out no new action for customers; readers should follow any direct communication from the company rather than acting on rumours.

Source: Good Smile Company