Overview
- Capcom disclosed that a third party accessed 11,774,247 CAPCOM ID records containing email addresses and account metadata such as account creation and last-login timestamps, login counts, and last-login IPs.
- The company confirmed that attackers changed passwords on 196 accounts and that those passwords have been reset by Capcom; the intrusion also exposed additional personal fields for 43 accounts.
- Capcom found the intrusions after detecting suspicious activity on Monday, October 19, and set up an internal incident response headquarters before reporting the incident to Osaka police and Japan’s Personal Information Protection Commission.
- The publisher says no user-set passwords or credit card/payment card data were confirmed leaked, but it has completed emergency measures, addressed the attack method, and opened dedicated support channels to notify affected users.
- The breach heightens phishing and fraud risk because attackers have email addresses and login metadata, and it follows Capcom’s 2020 ransomware incident, underlining ongoing privacy and security risks for centralized game account services.