Capcom confirms CAPCOM ID breach exposing data of 11.7 million accounts

Japanese video game publisher Capcom has confirmed that attackers breached CAPCOM ID, the shared account system used for its web services and some of its online games, exposing information tied to more than 11.7 million customer accounts. According to BleepingComputer, the company disclosed the incident on October 22 in an alert published on its investor relations website. The breach is significant because of its scale: exposed email addresses combined with account activity data give attackers material for convincing phishing campaigns aimed at Capcom's large player base.

What happened

As reported by BleepingComputer, Capcom detected suspicious activity on October 19 and confirmed unauthorized access to CAPCOM ID. The company said it launched an investigation immediately, and by October 20 it had determined that customer information had been compromised. On October 21, Capcom reported the incident to police and to Japan's Personal Information Protection Commission, before going public a day later.

Capcom said it has identified how the attackers got in and has put additional security measures in place to prevent similar incidents, but it has not shared details about the initial access vector. BleepingComputer noted that the company did not say when the intrusion began, and no threat actor has publicly claimed responsibility.

What data was exposed

According to the company's statement as reported by BleepingComputer, the following data was exposed for all affected accounts:

• email addresses
• account creation dates
• last login timestamps
• the number of logins
• the IP address used at the last login

For 43 accounts, dates of birth, gender, nicknames and countries were also exposed. In 196 cases, the attackers changed CAPCOM ID passwords and locked the owners out; Capcom says it has reset those accounts. The company stated that passwords for all other members were not exposed and that credit card information was not affected. Capcom also said its online services continue to operate normally.

Who is affected

The incident affects CAPCOM ID holders worldwide. Capcom said it will notify affected customers in stages and has set up region-specific channels to handle support requests. BleepingComputer recalled that this is not the company's first major security incident: in November 2020, Capcom was hit by a Ragnar Locker ransomware attack in which the attackers claimed to have stolen 1 TB of data, and the company later said it had traced that intrusion to an old VPN device.

What to do

Capcom has urged users to stay alert for unsolicited messages, emails requesting additional information, and messages containing links or attachments. Because the exposed data includes email addresses and login history, users should treat any message claiming to come from Capcom about account security with caution and access their accounts only by typing the official address directly. Although Capcom says passwords were not exposed, users who reused their CAPCOM ID password on other services may want to change it and enable stronger sign-in protections wherever they are available.