Capcom Confirms Data Breach Exposing Over 11.7 Million CAPCOM ID Records

On October 22, Capcom disclosed a breach of 11,774,247 data records from its CAPCOM ID service. The company has begun notifying affected individuals.

What Information Was Exposed

The exposed data includes email addresses, account creation dates, last login times, login counts and the IP address used for the most recent access. In 43 cases, date of birth, gender, nickname and country or region were also exposed.

The attackers changed the passwords on 196 accounts, which Capcom has since reset. The company has not confirmed that any user-set passwords were leaked. Payment card data was not affected. The record count does not equal the number of compromised accounts, nor does it reflect a confirmed number of unique individuals.

What We Know About the Incident

Capcom confirmed unauthorized access on October 19 and a breach of customer data the following day. On October 21, the company reported the incident to the police and to Japan’s data protection authority. The public announcement followed on October 22.

The company says it has identified and blocked the attack vector. The investigation is ongoing, and services remain available.

What to Watch Out For

• Check for updates on Capcom’s official channels.
• Be cautious with messages that request personal information or contain unexpected attachments.
• Navigate to the login page yourself rather than following links.

SecurHUB Commentary

An email address combined with account history can make a phishing attempt far more convincing. Security audits help assess how well your data is protected and how prepared your organization is to respond to incidents.

Sources: Capcom, BleepingComputer