Good Smile Company, the figure maker behind the Nendoroid line, said on Oct 29, 2026 that a malicious program had been planted on the credit card payment page of its official online shop, potentially exposing the card details of 2,800 people.
The data at risk includes cardholder names, all 16 digits of card numbers, expiry dates and security codes, the company said in a third statement on the breach. Security codes are not stored by merchants, so their exposure points to code that read the checkout form as customers typed.
The company said it found the program on the payment page on Oct 28 at about 6:30 p.m. The page had carried it from Oct 21 at 1:55 p.m. until Oct 23 at 7 a.m., roughly 41 hours.
How the breach unfolded
Unauthorized access to the Good Smile Company Official Shop began sometime after 3 p.m. on Oct 19 and continued until shortly before 11 p.m. on Oct 22. Just after 6 a.m. on Oct 23, the contractor handling system development and maintenance called the company, which shut the shop at 7 a.m.
The 2,800 people include 384 who completed an order by card and 185 who changed their payment card after placing a reservation. It also covers customers who entered card details but did not finish paying, and those who logged in and put items in a cart without reaching checkout.
Some operation logs were not retained, so the company could not fully separate those groups and notified the wider pool.
A second, larger group of saved cards
Customers who had previously saved card details to the shop may also have had the last four digits of their card number and the expiry date exposed. The company is still counting how many people are affected, but the number of cards that may be involved, with duplicates removed, comes to 402,466.
Good Smile Company is one of Japan's best-known figure makers, and its shop sells to collectors overseas as well as domestically. The company has not said whether customers outside Japan are among the 2,800.
It advised affected customers to check their card statements and to contact their card issuer. The company has not said when the shop will reopen.