Overview
- Capcom says a third party accessed 11,774,247 CAPCOM ID records, primarily exposing email addresses and system-specific identifiers such as account creation and last-login timestamps, login counts, and last-login IP addresses.
- The company confirmed 43 accounts also had additional personal fields accessed and that attackers changed passwords on 196 accounts, all of which Capcom has reset.
- Capcom detected suspicious activity on Monday and then formed an internal incident response team the next day before reporting the breach to Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21; the company disclosed the breach publicly on Thursday and says emergency measures and a fix to the attack method are complete.
- Capcom says customer-set passwords and credit card or payment details have not been confirmed leaked, services using CAPCOM ID remain available, and the firm warns users to watch for phishing and to use official support channels for inquiries.
- CAPCOM ID is required for online play in titles such as Street Fighter and Monster Hunter, meaning millions of players worldwide may be affected and the exposed metadata could be used for targeted phishing or social-engineering attacks; Capcom also faces scrutiny after a separate large data incident in 2020.