CAPCOM says 11.7 million CAPCOM ID records were accessed in a data breach

Capcom says an unauthorized third party accessed 11,774,247 CAPCOM ID records worldwide. The breach affects the shared account system used for Capcom web services and some online games. Most of the accessed data includes email addresses, account creation dates, last login times, login counts, and the IP addresses used for the most recent sign-ins.

Capcom says it spotted the suspicious activity on October 19 and began blocking it that same day. The company notified the Osaka Prefectural Police and the Personal Information Protection Commission of Japan on October 21.

While Capcom says it found no evidence that customer-set passwords or credit card information were compromised, unauthorized parties modified credentials for 196 accounts. Capcom has since reset those passwords. For 43 accounts, the exposure included nicknames, gender, country or region, and dates of birth. Additionally, the attackers opened e-Capcom store pages for 19 accounts, which exposed personal details including names, contact numbers, physical locations, and buying records for Japanese users.

Capcom has not disclosed how the attackers gained access, but says the method has been identified and dealt with. Services and titles continue to function. The company advises users to treat messages claiming to be from Capcom with suspicion due to the risk of phishing.