Good Smile Company reports potential leak of full credit card information of 2,800 customers in major data breach
According to Good Smile Company, the data leak is not related to the recently reported PHP vulnerability issue.
Japanese video game developer and toy manufacturer Good Smile Company made an update on October 29 regarding the possibility of customer information being leaked during a recent security breach. This is the third update the company has made since the initial announcement that it suffered a data leak on October 23. Most notably, credit card information belonging to about 2,800 online shop users has been potentially compromised, including the card holder’s name, full credit card number, expiration date, and security code.
According to the most recent update, Good Smile Company confirmed several instances of unauthorized access to the website between 3:00 PM on October 19, and just before 11:00 PM on October 22. The company’s online shop was consequently closed off on October 23. While a certain cause of the data leak still hasn’t been determined, the company believes it occurred due to a third party exploiting a vulnerability in the website’s system, which gave them unauthorized access to administrative privileges.
One important thing to note is that the data leak is not related to the recently reported PHP vulnerability issue.
Good Smile Company has individually contacted each of the affected 2,800 customers via email with additional information. This includes 384 customers who placed an order using credit card payment, 185 customers who changed their credit card information after preordering an item, those who attempted to pay by credit card but were unable to complete the payment, and those who logged into the site and added items into their shopping cart without going through with their payment (during the previously specified time frame of the security breach).
Regarding those who just added items into their shopping cart, it is very unlikely that their personal information has been compromised. However, due to technical limitations which make the system difficult to distinguish between “those who attempted to pay by credit card but were unable to complete the payment” and “those who logged into the site and added items into their shopping cart without proceeding with their payment,” everyone who potentially falls in either of these two categories has received an email.
In addition to the full leakage of customers’ credit cards, Good Smile Company also warns of the possibility that over 400,000 credit cards have been partially leaked in the cyberattack (excluding duplicates). Furthermore, 7,673 customers who placed orders between 10:20 PM and 11:00 PM on October 22 are suspected to have had their personal information compromised, including full names, addresses and phone numbers.
According to Good Smile Company, the matter has already been reported to the Personal Information Protection Commission, and the company is currently in the process of contacting individual credit card companies.
The Good Smile Company official online store will be reopened once the website’s security has been ensured.
Đorđe P
Articles: 517Related Posts
