Capcom reports unauthorized access to Capcom ID

Capcom disclosed that its CAPCOM ID online membership service was subject to unauthorized access by a third party. The company said it detected suspicious activity on October 19, confirmed unauthorized access the same day, and began blocking access while investigating. It set up an internal incident response headquarters on October 20 and reported the incident to Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21.

As of October 22, Capcom said 11,774,247 records worldwide containing email addresses and system-specific identifier information, such as account creation and last login dates, login counts, and last-used IP address, were affected. Of that total, 43 records also had date of birth, gender, country or region, and nickname exposed, and 196 accounts had their login passwords changed without authorization; those passwords have since been reset. Capcom said no credit card information was involved, and it has not confirmed that any customer-set passwords themselves were compromised.

Capcom said it has completed emergency response measures, identified and addressed the attack method, and that CAPCOM ID services, including game access, remain available throughout. The company is warning customers that the exposed information could be used for phishing attempts impersonating Capcom, and has set up dedicated support channels in Japan, the Americas, Europe, the Middle East and Africa, and Asia-Pacific for affected customers.

Why it matters

A breach touching nearly 12 million accounts at a major game publisher is a reminder that even non-financial account data fuels large-scale phishing campaigns.

Source: Capcom