Capcom confirms CAPCOM ID breach exposed 11,774,247 records

Capcom has disclosed that an unauthorized third party got into customer data tied to CAPCOM ID, the single account used across its web services and needed for some of its online games. In a press release dated October 22, the publisher put the number of affected records at 11,774,247 worldwide, then followed up on October 23 with the final scope of the damage.

What was exposed

e-Capcom is the company’s online store in Japan. Capcom says it found no sign that passwords customers set themselves were compromised, and that credit card information was not part of either set of affected data. The other hijacked accounts showed no further data loss, according to the October 23 update.

Timeline

• October 19: Capcom detected suspicious activity on CAPCOM ID, started blocking it and confirmed the same day that unauthorized access had taken place.
• October 20: An internal incident response headquarters was set up, and the company reported the case to its external advisory body on IT security.
• October 21: Capcom notified the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
• October 22–23: The two public notices went out; the second says the investigation into the scope of impact is complete.

What players should do

Capcom says the attack method has been identified and dealt with, and that games and other services using CAPCOM ID keep running normally. Registered email addresses can stay in use. The company warns that the leaked data could be used for phishing emails, texts or calls posing as Capcom, and advises against opening links or attachments in suspicious messages. It plans to contact affected customers and has opened dedicated support channels: a toll-free line in Japan, the Capcom support inquiry form for the Americas and EMEA, and email support for Asia and Oceania.