Capcom disclosed a data breach affecting its Capcom ID online membership service on Oct. 22, with more than 11.7 million account records exposed worldwide, according to IGN. [Editor: relink “Capcom ID” to a Capcom-specific TAM article, or move the gaming news category link to an anchor that matches it.]
The company detected suspicious activity on Oct. 19 and confirmed the intrusion that same day. The breach exposed 11,774,247 records containing email addresses, IGN reported. A much smaller set of 43 records also included date of birth, gender, country or region and nickname. Capcom said 196 accounts had their login passwords changed without authorization.
What the Capcom data breach exposed
Along with email addresses, the exposed records showed when each account was created, when it last logged in, how many times it had logged in and the IP address used for that last login, according to IGN.
Capcom said it has not confirmed any compromise of passwords that customers set themselves. Credit card information was also not among the affected data, the company said.
Capcom has already reset the passwords tied to the 196 accounts where unauthorized changes were detected.
In an Oct. 23 update, Capcom said the intruder also opened the e-Capcom store account pages of 19 of those 196 accounts. E-Capcom is the company’s online store in Japan, and the exposed details for those customers included names, phone numbers, addresses, birth dates and purchase histories. Credit card information was not affected there either.
What it means for Capcom ID account holders
Capcom told customers they can keep using the email addresses registered with their Capcom ID, but warned that the exposed account information could be used to send fraudulent emails.
“If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files,” Capcom said, according to IGN.
Capcom said services that use Capcom ID, including its games, remain available. Players can still log in to titles like “Street Fighter 6” that require the account for online play, but any email claiming to come from Capcom deserves a second look.
Capcom’s response and reporting to authorities
Capcom reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on Oct. 21, according to IGN.
The company said it has completed emergency response measures and has identified and addressed the attack method behind the breach.
“Capcom takes this matter extremely seriously and will continue its detailed investigation,” the company said. “Based on the findings of the investigation, it will implement measures to prevent recurrence and further strengthen its information security framework.”
What’s next
Capcom has not explained how the attack was carried out. The company said it will keep monitoring Capcom ID and its related services, so account holders should watch for further updates.
Don't stop here
Every Score. Every Story. One Home.
Breaking sports, entertainment and news from across the Total Apex network, updated all day.
Get the Full Story →
