Capcom confirms data breach affecting 11.7 million accounts

Japanese gaming giant Capcom has confirmed that hackers broke into its CAPCOM ID account system and accessed the data of more than 11.7 million customers. The exposed information consists chiefly of email addresses, together with associated account details.

Beyond the email addresses, the breach exposed account creation dates, last-login timestamps, login counts, and the IP address used at the last login. For a small subset of 43 accounts, dates of birth, gender, nicknames, and countries were also compromised.

In another 196 cases, the attackers changed the CAPCOM ID passwords in an attempt to lock owners out of their accounts, but the company managed to reset them. In its notice, Capcom stresses that passwords for all other registered members were not exposed and that payment card data remained untouched.

Timeline of the incident

CAPCOM ID is the company's shared account system, used to access its web services and to play some of its online games. Capcom is known for franchises such as Resident Evil, Monster Hunter, Street Fighter, and Mega Man; it employs around 4,000 people and reports annual revenue of $1.24 billion.

The exact timing of the intrusion remains unclear. The company detected suspicious activity and confirmed unauthorized access on October 19. An investigation began immediately, and by the following day it was clear that customer data had been compromised. On October 21, Capcom reported the incident to the police and to Japan's Personal Information Protection Commission.

Capcom says its online services remain unaffected but urged users to stay vigilant toward unsolicited messages, requests for additional information, and emails containing links or attachments.

During the investigation the company identified the method of intrusion and put in place measures to prevent a recurrence, though it has not disclosed any details about the initial access. Affected customers will be notified in stages — evidently because of the large number of accounts involved — and region-specific channels have been set up for support requests.

Not the first time

This is not Capcom's first major incident. In November 2020 the company was hit by the Ragnar Locker ransomware group, which claimed to have stolen 1 TB of data; Capcom later warned that up to 390,000 people could be affected. In April 2021 it emerged that the attackers had gained entry through an outdated VPN device.

Source: Bleeping Computer