Capcom says a third party broke into Capcom ID, the free account that powers online features in some of its games, and walked away with customer information tied to more than 11 million accounts. In a statement posted to its investor relations site on Thursday, October 22, the Resident Evil and Street Fighter publisher put the total at 11,774,247 accounts worldwide.
The company says it has finished its emergency response and that services using Capcom ID, including its games, remain available. Play is not affected in any game.
What was taken
For every affected account, the intruder accessed the email address along with system data: when the account was created, when it last logged in, how many times it has logged in, and the IP address used for the most recent login. For 43 of those accounts, the leaked data also included date of birth, gender, country or region, and nickname.
Capcom says it has found no sign that passwords set by users were exposed. However, the attacker did change the passwords on 196 accounts without permission. Capcom has already reset those accounts and says it will contact affected customers individually. Credit card information was not part of the leak.
How it unfolded
According to the timeline Capcom shared, the company spotted signs of unauthorized access on October 19, cut off the access the same day and confirmed the intrusion. On October 20 it set up an internal response team, learned that customer data had leaked, found the unauthorized password changes and reported the incident to its outside Security Oversight Committee. On October 21 it reported the breach to police and to Japan’s Personal Information Protection Commission.
The bigger risk now is phishing. Because email addresses were exposed, Capcom warns that people may receive messages pretending to be from the company or its partners. It asks users not to click links or open attachments in any suspicious email, and it has opened dedicated support contacts for each region.
As VGC points out, this is the second major security incident for Capcom after a 2020 ransomware attack that exposed personal data of customers and former employees. Account security has been a recurring theme across the industry lately, including when Square Enix warned FFXIV players about account takeovers. If you use the same password for Capcom ID anywhere else, now is a good time to change it.
