From our other sites
The story
Good Smile Company has released its third report, following the October 23, 2026 notice, regarding a possible leak of customers’ credit card information caused by unauthorized access to its official shop. On the thread, many reacted with shock, saying things like “Wait, were they actually storing the security code?” — but plenty of others pointed out that the payment page itself had been tampered with, so entered information was being sent to an outside party in real time. The real debate ended up being over whether the data had been “stored” versus “stolen.”
To our customers,
Regarding the possible leak of customer information due to unauthorized access to the “Good Smile Company Official Shop” (hereinafter “this site”), which we announced on October 23, 2026, we would like to report the facts uncovered through our subsequent investigation and our current response, as follows.
Please note that some details have changed from what was reported up through our second report.
Source: support.goodsmile.com / Original article here
What people said
They need to be punished to the fullest extent.
Arrest them and throw them in the slammer.
It's not that Good Smile was storing it themselves — malware had been planted on the site, and it skimmed the input data of anyone who shopped during that window.
If it looks like your usual spending pattern, they won't contact you.
You have to check your own purchase history, no way around it.
I doubt they'd call.
Some card companies will just freeze your card on their own, though.
The payment page was tampered with, so the data leaked in real time exactly as it was entered, right?
The fact that they can't even pin down what was accessed means they never held the input data themselves to begin with.
They said something like 380 people were affected, so I figured it was some mom-and-pop shop — turns out it's actually a decent-sized company.
Maybe I should cancel all my credit cards while I still can…
If you're serious about protecting yourself, that's really the only way.
A company that makes a living selling "moe moe kyun" charm 🤣 (moe = cute, anime-style appeal)
Just look up Good Smile Company's page on Amazon and you'll see.
So you're saying the security code was only captured after the intrusion happened?
Sure, they're a victim of the unauthorized access too, but there should still be some kind of penalty.
Read more carefully.
The credit card payment page was tampered with, and the information entered at checkout was sent straight to the attacker.
It's not that stored data got stolen in a breach — it was skimmed live.
According to contracts obtained by journalist Justin Ling, Good Smile Company held a 30% stake in 4chan [7][19].
In the 2015 deal to acquire 4chan, the funding came from Hiroyuki Nishimura personally ($800,000, roughly ¥100 million), a company owned by Nishimura ($4.8 million, roughly ¥640 million), and Good Smile Company ($2.4 million, roughly ¥320 million).
Oh, so it's a Hiroyuki-connected company.
Apparently Hiroyuki's got like 10 billion yen in assets.
And he still goes around looking down on other people lol
Why would the security code even be exposed in the first place?
Because the payment screen was being skimmed in real time.
Well, usually it's some security hole that's been left unpatched that lets them skim the entered data.
The entered data was what got skimmed.
Meaning they left that kind of bug sitting there unpatched.
They don't store it in-house, which is probably why they don't even know exactly what was taken.
How many times do people have to say they weren't storing it?
No brainpower to spare for understanding that it wasn't stored — it was the entered data getting stolen on the spot.
Plenty of those types swarming this very thread too.
And people at that level are apparently what's holding up Japan's IT industry.
Background and key points of this story
The security code (CVV) entered at checkout is prohibited from being stored by merchants under the industry-standard PCI DSS, so the shocked reaction of “wait, were they storing it?” doesn’t match reality. The method used here — where the payment page itself is tampered with so that entered information is sent to an outside party on the spot — is known as “formjacking,” and it works differently from a leak of stored data. As thread post 223 points out, this kind of mix-up — assuming the data had been “stored” — tends to resurface every time this type of incident is reported, as was also seen in the earlier Suruga-ya case. Separately, one post linked Good Smile Company to a stake in 4chan, but that is unverified information circulating on an anonymous forum and is unrelated to the findings of the investigation into this unauthorized access incident.
*This article is excerpted and summarized from the 5ch (News Speed+) thread “Good Smile Company: Customers’ Credit Card Information Possibly Leaked Due to Unauthorized Access.”
Leave a Reply