Capcom data breach: intruders viewed 11.7 million Capcom ID account records
Email addresses and login data were affected, but not credit cards, Capcom says. 196 passwords were changed without authorisation. Capcom warns of phishing emails.
Symbolic image · Photo: Tokumeigakarinoaoshima / Wikimedia Commons, CC BY-SA 4.0 (cropped and resized)
Japanese publisher Capcom has confirmed unauthorised access to its online account system Capcom ID. According to the company, 11,774,247 records were viewed worldwide – including email addresses, account creation and last login times, login counts and the IP address of the last login. For 43 accounts, date of birth, gender, country and nickname were also exposed; 196 accounts had their passwords changed without authorisation and have since been reset.
Capcom says credit card data and passwords chosen by users were not affected, and playing Capcom titles is not restricted. The company detected suspicious activity on 19 October, reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission and says it has identified and addressed the attack method. When the access began and who is behind it remain unclear; the investigation is ongoing.
Capcom apologised and warned that the data could be misused for fraudulent emails impersonating the company. Users should not open links or attachments in suspicious messages. Anyone who can no longer log in may be among the 196 reset accounts and should contact support.