Good Smile Company has announced that several customers may have had their credit card information leaked as part of a security breach.

A third update from October 29 explained that 2800 users who entered a name, credit card number (all 16 digits), expiration date and security code on the website between 1:55PM JST on 21st October 2026 and 7:00AM JST on 23rd October 2026 may have been affected. Emails are being sent out separately to those implicated.

What's more, customers who had registered their credit card information on the website beforehand may have had parts leaked, namely the last four digits and expiration date.

The update clearly states that the breach had nothing to do with the PHP vulnerability that brought down much of the internet last week.