Good Smile Company: Full Credit Card Details for 2,800 Customers May Have Been Exposed in Data Breach
Good Smile Company released on Thursday a new update regarding the data breach on its online store where an "unauthorized third party" gained access to personal and other information if its members. The company stated that its investigation has established that a malicious program was present on the website's credit card payment page from October 21 at 1:55 p.m. JST to October 23 at 7:00 a.m. JST. The information concerning the installation of the malicious program was discovered on October 28 shortly after 6:30 p.m. JST. The company stated that the vulnerability believed to be the cause of the issue is different from the PHP vulnerability.
The company now states that 2,800 customers who may have entered their information on the website's credit card payment page during that time may be affected by the issue, and their information such as cardholder's name, complete 16-digit card number, expiration date, and security code may have been exposed. The company stated that it has contacted the affected customers by email separately.
Additionally, the company stated that customers who have previously registered their credit card information on the website may have their partial information exposed, including the last four digits of the card and expiration date. The company confirmed that cardholders' names or security codes have not been exposed, and no registered member information linked to the exposed partial information was exposed. The company estimated that the number of credit cards that may have partial information exposed is 402,466 excluding duplicates.
The company added that 7,673 customers who placed orders on October 22 between shortly before 10:20 p.m. JST and shortly before 11:00 p.m. JST may have their order information exposed. Information that may have been exposed include: shipping and/or billing name, shipping and/or billing address, shipping and/or billing telephone number, email address, order details, order amount, and payment method. The company stated that information relating to 202 orders was viewed without authorization, but since the website's system does not allow the company to fully identify which order information was viewed, the company considers all customers associated to the 7,673 orders may have been affected.
The company took the online store down when it discovered the breach on October 23, and is currently investigating the incident. Good Smile Company claimed that it has since "strengthened system security," and added that it has removed the vulnerability that it identified as the cause for the security breach. The company has also reported the incident to Japan's Personal Information Protection Commission, in accordance with Japanese law.
Sources: Email correspondence, Good Smile Company's website
follow-up of Good Smile Company Announces Data Breach of Online StoreKioskNews shows a cleaned-up reading view extracted from the publisher’s page — the original always lives on their site, not ours.