Capcom says 11.7 million Capcom ID records were accessed in a breach, and 196 passwords were changed

Capcom detected the intrusion on 19 October. Email addresses and login data were taken, 196 accounts had their passwords changed, and 19 Japanese store accounts exposed home addresses.

AI-drafted from 3 sources. This story was written with AI from the outside reporting listed under Sources, and checked by automated tools before it went up. The originals have the full detail.

Capcom has confirmed that someone got into Capcom ID, the account system it uses for online features and multiplayer in games such as Street Fighter 6, Monster Hunter and Resident Evil. In a notice published on 22 October, the publisher said 11,774,247 records worldwide were affected.

Those records are email addresses plus what Capcom calls system-specific identifier information: when the account was created, when it last logged in, how many times it has logged in, and the IP address used for the last login. For 43 of those accounts, date of birth, gender, country or region and nickname were also accessed. Capcom says it has not confirmed that any password chosen by a customer was compromised, but passwords were changed without authorisation on 196 accounts. Those have been reset. Credit card information was not among the data taken.

How it unfolded

According to Capcom's timeline, it noticed suspicious activity on 19 October, began blocking the access and confirmed the same day that an intrusion had happened. On 20 October it set up an internal incident response headquarters and told its external security advisory committee. On 21 October it reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission. Capcom says it has identified and dealt with the method of attack, and that Capcom ID and the games that use it remain available.

A day later, an update on 23 October filled in what happened to the 196 hijacked accounts. For 19 of them, all in Japan, the intruder also opened the account pages of e-Capcom, the company's Japanese online store. That exposed each person's name, the phonetic reading of the name, phone number, postcode, address, gender, date of birth, purchase history, customer support history and saved address book. Capcom found no other data taken through the remaining changed accounts and says its investigation into the scope of the incident is now complete, though it will keep monitoring Capcom ID.

What Capcom is telling players

Capcom says email addresses registered with Capcom ID can keep being used, but warns that the stolen data could be used for fake emails, texts or calls that pretend to come from Capcom or related companies. Its advice is to be careful with any unexpected message and not to open its links or attachments. It will contact affected customers directly, and has set up support channels for the incident: a dedicated phone line in Japan and the Capcom support site for the Americas, Europe, Asia and Oceania.

As GamesIndustry.biz points out, this is not Capcom's first security incident. A ransomware attack in November 2020 compromised the personal data of 16,415 people. Capcom has not said who was behind the new intrusion or how they got in.

Sources

Image: Image: Capcom, via GamesIndustry.biz