If you've ordered a Nendoroid or figma from Good Smile Company's online store, check your inbox. On October 28, 2026, the company disclosed that an outside party got into its online shop between October 19 and 22, and that customer data was exposed.
What leaked
Per Anime News Network's report on the notice, the exposed data includes member names, gender, addresses, email addresses, phone numbers and order details, plus partial card data: card brand, the last four digits and the expiry date. Good Smile says full card numbers, cardholder names and security codes were not accessed. It hasn't said how many customers are affected.
What Good Smile did
The company found the intrusion on October 23, took the store offline, closed the vulnerability it identified and says it has strengthened security. It reported the incident to Japan's Personal Information Protection Commission, as Japanese law requires. Only the online store was hit. Good Smile also makes games and invests in anime, including this fall's mecha original Juuou Mujin Dandivine.
What to do
- Expect phishing. With names, addresses and order histories out there, a fake "your order has a problem" email looks believable. Don't click store links in unexpected mail.
- Watch your card statements, even though the full number wasn't taken.
- Change your Good Smile password, and change it anywhere else you used the same one.
More SenpaiRanks guides: most popular anime of October 2026, what to watch in winter 2027, best mecha anime.
Frequently asked questions
Q: Was my credit card number stolen in the Good Smile breach?
A: According to the company, no. Only the card brand, last four digits and expiry date were exposed. Full card numbers and security codes were not.
Q: When did the Good Smile breach happen?
A: Between October 19 and 22, 2026. It was found on October 23 and announced on October 28.
Q: Which Good Smile service was affected?
A: Only the Good Smile Company online store.