Science & Tech · Cybersecurity · 2 hrs ago
Good Smile Company Says Online Store Breach May Expose Card Data
Good Smile Company found a malicious program on its online store’s payment page after detecting unauthorized access to the store.
About 2,800 people may have exposed full card details if they used the payment page between October 21 and 23, including card numbers, expiry dates and security codes.
Separately, data from 402,466 previously saved cards may have been exposed, but only the last four digits and expiry dates; the company says cardholder names and security codes were not involved in that case.
Order information for 7,673 customers may also have been exposed after orders placed late on October 22, although the company confirmed that 202 orders were actually viewed.
The store was closed on October 23 after the company was alerted to the unauthorized access.
The company warns that leaked details could be used in scam calls, messages or emails, and asks affected customers to check their card statements and contact their card issuer about unfamiliar charges.
The company says it is still checking who may be affected by the saved-card exposure.
Good Smile Company said an unauthorized access incident at its online store may have exposed full payment-card details for up to 2,800 customers.
The potentially exposed information includes cardholder names, all 16 card-number digits, expiry dates and security codes.
For cards previously registered on the store, the last four digits and expiry dates may have been exposed for 402,466 cards.
Personal and order details for 7,673 customers who placed orders during a separate period may also have been viewed.
The company closed the store on October 23 and said it would announce reopening after confirming the site is safe.
- Who
- Good Smile Company and customers of its official online store.
- What
- Unauthorized access and a malicious program may have exposed payment-card and customer information.
- When
- The card-payment page was affected from October 21 at 1:55 p.m. until October 23 at 7 a.m.; the company announced its findings on October 29.
- Where
- Good Smile Company’s official online store.
- Why
- The company believes an attacker exploited a vulnerability in part of the system to obtain administrator privileges.
This story does not have two clearly opposing sides.
The official store experienced unauthorized access, and administrator privileges were improperly obtained.
A malicious program was placed on the credit-card payment page.
Good Smile Company closed the store after being contacted by its system maintenance contractor.
The company confirmed that the payment page had contained the malicious program.
The company published its third update, saying full card details may have been exposed for up to 2,800 customers.
- Customers potentially affected by full card-data exposure
- Up to 2,800
- Previously registered cards potentially affected
- 402,466
- Customers whose order details may have been viewed
- 7,673
- Orders actually viewed
- 202
- Store closed
- October 23 at 7 a.m.
4 sources
What people are saying
I’ve never seen this much credit-card information stolen before
The leak of credit-card numbers is critical…