Capcom confirms breach of more than 11.7 million accounts
A third party accessed emails and IP addresses of CAPCOM ID users; no cards were involved and the company warns of fake emails in its name.
An unauthorized third party accessed customer information from CAPCOM ID, the unified account of the publisher of Resident Evil and Monster Hunter, the company confirmed Thursday in an investor notice.
The breach covers 11,774,247 records worldwide. Each includes the email address, when the account was created, when and how many times it was last used, and from which IP address. In 43 records, the date of birth, gender, country or region and nickname were also exposed.
No card data was involved. Capcom says credit card information was not among what was affected, and that its online services and games keep working.
A separate case: 196 accounts had their passwords changed without authorization. They have been reset, and the company has not confirmed that passwords users created themselves are compromised.
How it unfolded
Capcom detected suspicious activity on Oct. 19, blocked it the same day and confirmed the access. On Oct. 20 it set up a response team, and on Oct. 21 it reported the case to Osaka police and Japan's personal data regulator. It says it has identified and addressed the attack method but does not detail it.
It is also unknown who was behind the attack or whether the data is circulating on forums.
What to do if you have a CAPCOM ID
With that data exposed, phishing is the most likely risk: messages that imitate Capcom or related companies. The company asks people not to open links or files in unexpected emails, and says it will contact affected users directly.
This is not the first hit of this kind: in November 2020 the company reported access to its internal network. This time the target was the registry of player accounts, with 11,774,247 records.
