---
title: Two more Japanese retail breaches: Good Smile Company's web shop exposed member and order data, and Treasure Factory lost about 746,000 customer emails | ctxsec
url: https://ctxsec.com/items/japan-retail-breaches-good-smile-treasure-factory-oct-23
description: ""
status: "confirmed (Good Smile Company notice and Treasure Factory disclosure, both Oct 23); causes still under investigation"
published: 2026-10-23
---

> 

[← Cybersecurity News](/news) · [markdown](/items/japan-retail-breaches-good-smile-treasure-factory-oct-23.md)

confirmed (Good Smile Company notice and Treasure Factory disclosure, both Oct 23); causes still under investigation

2026-10-23

### Two more Japanese retail breaches: Good Smile Company's web shop exposed member and order data, and Treasure Factory lost about 746,000 customer emails

Two Japanese retailers disclosed intrusions on **Oct 23**, both blamed so far on an unnamed vulnerability in a web-facing system.

- **Good Smile Company** (figure maker): log analysis found repeated unauthorized viewing of the official online shop's admin data from about 3 PM on **Oct 19** to about 10 PM on **Oct 22** (Japan time). Possibly exposed: names, addresses, phone numbers, emails, gender, order details, and card brand, **last four digits and expiry date**. Full card numbers, cardholder names and security codes were not included. The shop is closed with no reopening date, the suspected flaw has been fixed, and Japan's privacy regulator was notified.
- **Treasure Factory** (secondhand retailer): attackers abused a database-access vulnerability in the case-management system behind its home-pickup buying and moving services early on **Oct 20**, taking about **746,000 customer email addresses** (a handful with names and addresses), plus about 750 partner and staff names and emails. No payment data was involved. The company says this was **not** the recent PHP2Shell flaws, and it is its group's second incident since August (the earlier one at subsidiary Kindoll was phishing). Forms are due back around Oct 28.

For customers of either: expect targeted phishing that quotes real order details, and don't trust emails, texts or calls claiming to be from these companies.

Sources: [Good Smile Company notice (Japanese, Oct 23)](https://support.goodsmile.com/hc/ja/articles/63547468806297) · [Treasure Factory notice (Japanese, Oct 23)](https://www.treasure-f.com/info/detail/st825/) · [Treasure Factory timely disclosure PDF (Japan IR)](https://japanir.jp/wp-content/uploads/2026/10/3093-20261023-01.pdf) · [Denfaminicogamer report (Oct 23)](https://news.denfaminicogamer.jp/news/2610233k)