Capcom says unauthorized access to its CAPCOM ID membership service exposed 11,774,247 customer records worldwide, making the incident substantially larger than the 11 million email addresses initially reported. The Japanese game publisher detected suspicious activity on October 19 and has since blocked the attack method, notified authorities and begun contacting affected customers, according to its official notice.
The exposed records contained email addresses and account metadata, including account-creation and last-login timestamps, login counts and the client IP address used during the most recent login. A separate 43 records also included dates of birth, gender, country or region and nicknames. Capcom said it has not confirmed the theft of passwords originally set by customers, and that credit-card information was not included in the affected data.
Attackers nevertheless changed the CAPCOM ID login passwords for 196 accounts. Capcom says those passwords have been reset, but its October 23 update found that 19 of those accounts were subsequently used to access e-Capcom shopping pages in Japan. Information exposed in those cases included names, telephone numbers, postal addresses, gender, dates of birth, purchase histories, customer-service inquiries and address-book data. Capcom said credit-card information was not exposed in those accounts either; the details are in the company’s second incident update.
CAPCOM ID is a shared account used to access Capcom web services and some online games. The company says its emergency response is complete, the service remains available and the breach has not prevented players from accessing or playing games. Capcom has reported the incident to Japan’s Osaka Prefectural Police and Personal Information Protection Commission, while continuing to monitor the service and strengthen its security controls.
The immediate risk for the broader affected population is targeted phishing and impersonation. Email addresses paired with login history and network information can give attackers useful material for convincing messages that appear to come from Capcom or an associated service. Capcom is warning customers not to open suspicious attachments or follow links in unsolicited email, text messages or other communications, and recommends using official support channels rather than responding directly to breach-related requests.
