News
Good Smile Company Partially Reopens on November 6 Following Data Breach of Online Store
posted on by Alex Mateo
The company also revealed that it has restored the online store to its state before the unauthorized access from a backup. It has also repaired vulnerabilities in its administration system and strengthened its procedures in order to prevent recurrence. The company also plans to strengthen its web application firewall against cyberattacks and provide 24 hour monitoring. According to the company, an independent team of security specialists have determined that browsing the website poses no risk of viruses or the possibility of unauthorized customer information being obtained.
Account information, new account registration, new orders, cart additions, and Watchlist functions will remain unavailable until the independent investigation and security measures are complete.
Good Smile Company took the online store down when it discovered the breach on October 23, and is currently investigating the incident. The company claimed that it has since "strengthened system security," and added that it has removed the vulnerability that it identified as the cause for the security breach. The company has also reported the incident to Japan's Personal Information Protection Commission, in accordance with Japanese law.
The company stated that its investigation established that a malicious program was present on the website's credit card payment page from October 21 at 1:55 p.m. JST to October 23 at 7:00 a.m. JST. The information concerning the installation of the malicious program was discovered on October 28 shortly after 6:30 p.m. JST. The company stated that the vulnerability believed to be the cause of the issue is different from the PHP vulnerability.
The company added that 2,800 customers who may have entered their information on the website's credit card payment page during that time may be affected by the issue, and their information such as cardholder's name, complete 16-digit card number, expiration date, and security code may have been exposed. The company stated that it has contacted the affected customers by email separately.
Additionally, the company revealed that customers who have previously registered their credit card information on the website may have their partial information exposed, including the last four digits of the card and expiration date. The company confirmed that cardholders' names or security codes have not been exposed, and no registered member information linked to the exposed partial information was exposed. The company estimated that the number of credit cards that may have partial information exposed is 402,466 excluding duplicates.
The company added that 7,673 customers who placed orders on October 22 between shortly before 10:20 p.m. JST and shortly before 11:00 p.m. JST may have their order information exposed. Information that may have been exposed include: shipping and/or billing name, shipping and/or billing address, shipping and/or billing telephone number, email address, order details, order amount, and payment method. The company stated that information relating to 202 orders was viewed without authorization, but since the website's system does not allow the company to fully identify which order information was viewed, the company considers all customers associated to the 7,673 orders may have been affected.
Good Smile is a video game developer, hobby and toy merchandise manufacturer, anime producer, and online retail company. The company's signature toy lines are the popular Nendoroid and Figma figure lines. Nendoroid figures are small figures of anime, manga, and pop culture characters that are portrayed in a super-deformed style, and may have limited poseability and swappable faces. Figma is an action figure line of anime, manga, and pop culture characters that focuses on high articulation and poseability.
Source: Email correspondence
