BODY: Capcom now says its CAPCOM ID online account service has been breached.
On October 22, Capcom disclosed that a third party gained unauthorized access to CAPCOM ID, the company's online account service. Roughly 11,774,000 records were exposed worldwide. The bulk of what leaked is email addresses plus system-side identifiers: the account creation date, last login date and time, login count and the client IP address from the last login. A much smaller slice went deeper — 43 records included birth dates, gender, country or region and nicknames, while 196 accounts had their passwords altered without authorization.
Crucially, Capcom states that user-set passwords were not leaked and no credit card information was included.
The timeline was tight. Capcom detected traces of suspicious access on October 19, confirmed the intrusion on October 20, notified the police and Japan's Personal Information Protection Commission on October 21, and went public on October 22. Emergency countermeasures are described as complete, with the attack method identified and addressed, and CAPCOM ID services remain operational. Affected users are being contacted in turn, and a dedicated inquiry desk has been set up. Capcom is also warning players to be wary of suspicious emails impersonating the company or related parties, and not to open links or attachments in them.
The investigation into the full scope of the access is still ongoing.
The insider take
From Tokyo, the striking thing is the speed. When Capcom was hit by the Ragnar Locker ransomware attack in November 2020, the picture of what was exposed kept widening over months. This time the company moved from detection to public disclosure in three days. The practical advice is simple: be careful with email that claims to be from Capcom.
Originally reported by AUTOMATON (Japanese).