Capcom has disclosed a data breach of Capcom ID, the online membership service its games use for online play, saying a third party accessed information tied to more than 11 million accounts. Rock Paper Shotgun reported that the publisher first noticed suspicious activity around the service on October 19 and spent the following days containing the intrusion.
In a press release summarised by Rock Paper Shotgun, Capcom put the total at 11,774,247 accounts whose email addresses and what the company called system-specific identifier information were accessed. IGN reported that the exposed identifier data covered the date and time each account was created, the date and time of its last login, its number of logins, and the client IP address used at that last login. A further 43 records also had date of birth, gender, country or region, and nickname accessed.
Capcom said it has not confirmed any compromise of the login passwords customers set themselves, but that passwords were changed without authorisation on 196 accounts. Those passwords have already been reset. Credit card information was not among the affected data, the company said, and IGN reported Capcom does not expect its games to be affected.
Capcom warns of impersonation emails
Customers can keep using the email addresses registered with Capcom ID, the company said, but it warned that the exposed addresses could be turned against the people they belong to.
Email addresses registered with Capcom ID may continue to be used without interruption. However, there is a possibility that the affected information could be misused to send fraudulent emails or other communications impersonating Capcom or related parties. If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files.
Capcom said it reported the incident to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission as part of its initial response, and that it has completed emergency response measures after identifying and addressing the attack method involved. The company did not describe how the intrusion was carried out.
A detailed investigation is continuing. Capcom said it will notify affected customers, implement measures to prevent a recurrence based on the investigation’s findings, and publish updates through its official website and other channels if further disclosable facts emerge. The company also apologised to customers and other stakeholders.
Capcom ID is required to play online in games including Street Fighter 6, Rock Paper Shotgun noted. Capcom’s catalogue also includes the Resident Evil and Monster Hunter series.
