Japanese gaming giant Capcom has confirmed a major data breach affecting more than 11.7 million records linked to its CAPCOM ID membership service.
The breach exposed email addresses and account information belonging to users around the world.
Capcom said the incident was caused by unauthorised access by a third party and was detected on October 19.
The company has completed emergency security measures and says its games and online services remain available.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Email Addresses and Login Data Exposed
Capcom said 11,774,247 records were affected.
The exposed information includes users’ registered email addresses as well as system-specific account details.
These include the date and time an account was created, the date and time of the last login, the number of times the account was accessed and the IP address used during the most recent login.
An IP address can provide information about the internet connection used by a person and may help attackers create more convincing phishing messages when combined with an email address.
A much smaller group of users had additional information exposed.
Capcom said 43 accounts had data including date of birth, gender, country or region and nickname compromised.
The company has not disclosed why those 43 accounts contained additional exposed information.
Passwords Changed on 196 Accounts
Capcom also discovered that attackers had changed login passwords on 196 CAPCOM ID accounts.
The company has reset those passwords and is continuing to investigate whether the affected accounts were used for other unauthorised activity.
Importantly, Capcom says it has found no evidence that passwords originally created by customers were exposed.
Credit-card information was also not included in the affected data.
That reduces the immediate risk of direct payment-card fraud.
However, the exposed email addresses and account details could still be valuable to criminals.
Attackers may use the information to send phishing messages that appear to come from Capcom, gaming platforms or services associated with popular titles.
Capcom has warned customers not to click suspicious links or open unexpected attachments.
Attack Detected on October 19
Capcom said it detected suspicious activity involving CAPCOM ID on October 19.
The company immediately began blocking the unauthorised access while investigating the cause and scale of the incident.
Later that day, investigators confirmed that an unauthorised third party had accessed the system.
On October 20, Capcom created an internal incident-response headquarters and confirmed that customer information had been compromised.
The company also informed its external security advisory body.
On October 21, the breach was reported to Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
Capcom says it has now identified and addressed the method used in the attack.
However, it has not publicly explained how the attackers initially entered the system.
CAPCOM ID Services and Games Remain Online
CAPCOM ID is Capcom’s unified account system.
Players use it to access various Capcom web services and certain online gaming features.
The company says the breach has not affected users’ ability to play its games.
Services linked to CAPCOM ID also remain available.
That means the incident appears to involve unauthorised access to account information rather than a wider shutdown of Capcom’s gaming infrastructure.
Capcom says affected customers will be contacted individually.
Because more than 11.7 million records are involved, those notifications are expected to take place in stages.
Capcom Has Faced Major Cyberattack Before
This is not Capcom’s first significant cybersecurity incident.
In November 2020, the company was hit by a ransomware attack claimed by the Ragnar Locker group.
Attackers claimed to have stolen around one terabyte of data.
Capcom later said information relating to as many as 3.90 lakh people may have been affected.
The company eventually revealed that attackers had gained access through an older VPN device.
The latest CAPCOM ID breach is significantly larger in terms of the number of accounts involved, although the types of information exposed appear to be more limited for most users.
No ransomware group or other cybercriminal organisation has publicly claimed responsibility for the latest incident.
Phishing Could Become the Biggest Immediate Risk
For most affected users, the main exposed information is their email address and login metadata.
That may sound less serious than a password or credit-card leak, but it can still support targeted attacks.
A criminal who knows that someone has a CAPCOM ID account can send a message claiming that the account needs to be secured following the breach.
The victim may then be directed to a fake login page designed to steal their password.
Messages could also impersonate Capcom support staff or reference franchises such as Resident Evil, Monster Hunter or Street Fighter to make the communication appear genuine.
Users should therefore avoid signing in through links contained in unexpected emails.
Instead, they should navigate directly to Capcom’s official website or app.
Using a unique password and enabling additional account-security protections can also reduce the risk that a phishing attack against one gaming account spreads to other services.
What this means for you:
If you have a CAPCOM ID, be especially cautious of emails asking you to reset passwords or verify account details. Capcom says customer-created passwords and credit-card information were not exposed, but the leaked email and login data could still be used for targeted phishing.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
