If you bought a Nendoroid or a figma straight from Good Smile Company's own web store between October 21st and 23rd, check your email and your card statement this weekend!
Good Smile has confirmed that a malicious program sat on the credit card payment page of the Good Smile Company Online Store from 1:55 p.m. JST on October 21st until 7:00 a.m. JST on October 23rd (roughly 1 a.m. ET on October 21st to 6 p.m. ET on October 22nd). According to the company's latest notice, the full card details of up to 2,800 customers may have been exposed: the cardholder's name, all 16 digits of the card number, the expiration date and the security code.
That's a BIG change from where this started!
When Good Smile first disclosed the unauthorized access on October 23rd, and again when it expanded that notice on October 26th, the company said the only card data that could have been viewed was the card brand, the last four digits and the expiration date. It said outright that full card numbers, cardholder names and security codes weren't included. The third update on Thursday reversed that, as Anime News Network reported. Good Smile's FAQ says the store itself still only stored the last four digits and expiration dates. The full details were captured by a malicious program that intercepted what customers typed on the payment page.
Good Smile learned of the break-in on October 23rd, but the payment-page program didn't surface until October 28th. The company says the developer that maintains its store alerted it to the break-in shortly after 6:00 a.m. JST on October 23rd, and it pulled the store offline at 7:00 a.m. The payment-page program was found shortly after 6:30 p.m. JST on the 28th.
The 2,800 includes 384 customers who completed a credit card order during the window, people who entered a card but never finished paying, and 185 customers who updated the card on an existing pre-order, according to Good Smile. It also emailed customers who only logged in and added items to their carts. The company believes that group's cards weren't exposed, but its system can't tell them apart from the unfinished payments, so everyone got the warning. There's one group it can't identify at all: anyone who started changing the card on an order during that window and didn't complete the change.
Beyond the 2,800, the notice says the last four digits and expiration dates of 402,466 previously saved cards may have been exposed. Good Smile says it hasn't confirmed any exposure of names or security codes for those cards. Friday's fourth update also corrected the order figures. Good Smile says information from 202 orders was viewed, out of 7,774 orders that hadn't shipped, belonging to 5,356 customers as of shortly before 11:00 p.m. JST on October 22nd. Good Smile can't pin down which 202, so it emailed all 5,356. That data covers shipping and billing names, addresses, phone numbers, email addresses, order details, order amounts and whether you paid by card or PayPal. Thursday's update had put that group at 7,673 customers who ordered during a roughly 40-minute window on October 22nd.
The breach hit the main Good Smile Company Online Store at goodsmile.com, which runs in Japanese, English and Traditional Chinese (the English version is the store a lot of US collectors use) and has been down for maintenance since October 23rd. Good Smile says Good Smile Company US, the Good Smile Company Europe Online Shop, Good Smile Company UK, its Rakuten Ichiba store and Nendoroid Face Maker all run on separate systems and weren't affected. It also says card details for orders paid through Amazon Pay or PayPal were never stored on its servers.
As for how it happened, Good Smile says an attacker exploited a vulnerability in part of the store's system to grab administrator privileges. The company says it wasn't the PHP vulnerability that made the news recently. It has fixed the hole, reset the connection credentials between its internal systems, and reported the incident to Japan's Personal Information Protection Commission, and it plans to report to card issuers and payment processors next. There's no reopening date yet. Existing orders and pre-orders due to ship in October are still going out, and Good Smile says pre-orders hit with a payment error won't be canceled automatically.
So what should you do? Good Smile's FAQ for affected customers starts with your inbox. Look for an email with the subject line "[Important] Possible Exposure of Credit Card Information Due to Unauthorized Access to Our Online Store and Request for Action." If you're in the order-data group, the subject line is "[Important] Notice and Apology Regarding Possible Exposure of Order Information Due to Unauthorized Access to Our Online Store." Good Smile also emailed its general notice to every member, including former members, so getting an email doesn't by itself mean your card was hit. The subject line tells you which group you're in. If you got the card email, the company asks you to check your statements for any charges you don't recognize, call your card issuer using the number on the back of the card if you find one, and consider having the card reissued.
Good Smile says it can't request a replacement card for you, so that call has to come from the cardholder. It says it's asking issuers not to charge customers reissue fees, and that fraudulent charges are generally handled under each issuer's own fraud policies. Everyone else should watch for phishing too. The company warns the leaked data could be used in emails, calls or texts pretending to be Good Smile, a bank or a government office, and asks customers not to respond to unfamiliar senders or click their links. Questions go through Good Smile's support inquiry form, which runs on a separate system from the store.
Collectors hand that shop a LOT of pre-order money, often months ahead of release, and Good Smile has now posted four notices in eight days, two of them walking back earlier numbers.
Collectors who read that first 'no full card numbers' line and relaxed are the ones who need to go back and check!
What do you think? Did you get one of Good Smile's emails, and will you keep pre-ordering through its store once it reopens?
You Might Also Like