A Capcom data breach has exposed email addresses and account information belonging to more than 11.7 million CAPCOM ID accounts. The Japanese gaming company confirmed that attackers accessed its membership service and changed login passwords on 196 accounts.
Most exposed records contained email addresses and account activity details. However, a small group also had personal profile information compromised.
Capcom said credit card information remained unaffected. Its online services also continue to operate normally.
Attackers Accessed Email Addresses and Login Records
CAPCOM ID serves as a shared account system for the company’s web services and some online games. Capcom develops franchises including Resident Evil, Monster Hunter, Street Fighter and Mega Man.
According to the company, the exposed information included:
- Customer email addresses.
- Account creation dates.
- Most recent login timestamps.
- Total login counts.
- IP addresses associated with the last login.
Additionally, attackers accessed dates of birth, gender, nicknames and country information for 43 accounts.
These details extend beyond a basic email list. For example, account activity information could help criminals make fraudulent messages appear more convincing.
Hackers Changed Passwords on 196 Accounts
Attackers also changed the CAPCOM ID login passwords for 196 accounts in an attempt to lock out their owners.
In response, Capcom reset those passwords. The company said the incident did not expose passwords belonging to other registered members.
The distinction matters: the attackers changed credentials on a limited group of accounts, while the broader breach exposed email addresses and associated information.
Capcom Confirmed Unauthorised Access on October 19
Capcom detected suspicious activity and confirmed unauthorised access on October 19. It immediately launched an investigation.
By October 20, investigators had established that the intruders accessed customer information. Subsequently, the company reported the incident to police and Japan’s Personal Information Protection Commission on October 21.
Capcom publicly disclosed the breach on October 22. However, it has not specified when the attackers first entered the service.
During its investigation, the company identified the intrusion method and introduced measures to prevent similar incidents. It has not publicly explained how the attackers gained access.
Customers Should Watch for Suspicious Messages
Following the Capcom data breach, the company urged users to remain alert to unsolicited communications.
In particular, customers should treat unexpected requests for additional information with caution. Messages containing links or attachments also warrant careful scrutiny.
Capcom plans to notify affected customers in stages. Meanwhile, it has established regional support channels for people seeking assistance.
The company said its online services remain unaffected, although that does not remove the risk of criminals misusing exposed account information.
Earlier Ransomware Attack Involved an Old VPN Device
Capcom previously suffered a ransomware attack in November 2020, which the Ragnar Locker group claimed.
The attackers alleged that they stole one terabyte of data. Capcom later warned that the incident could affect up to 390,000 people.
In April 2021, the company disclosed that the intruders had entered its network through an old VPN device.
However, Capcom has not linked that earlier intrusion method to the latest CAPCOM ID breach.
0 responses to “Capcom Data Breach Exposes Information Linked to 11.7 Million Accounts”