Summary
- Capcom reports exposure of 11,774,247 email-address and account metadata records worldwide.
- Passwords on 196 accounts were changed without authorisation; access to linked e-Capcom data was identified on 19 of those accounts.
- Capcom has not confirmed theft of original customer-set passwords or payment-card details.
Japanese games publisher Capcom has disclosed unauthorised access involving 11,774,247 CAPCOM ID records worldwide, including registered email addresses and account metadata. The company says an attacker also changed passwords without authorisation on 196 accounts, while its follow-up investigation identified access to associated e-Capcom shopping information for 19 of them.
CAPCOM ID is the publisher’s unified account system for online services and certain multiplayer game features. Its reach extends beyond Japan to players using games and associated services across Europe and other markets. The security incident was detected on 19 October, with the company publishing its first notice on 22 October and additional findings on 23 October.
According to the original disclosure, the principal affected dataset contained email addresses and system identifiers associated with 11,774,247 records. Those identifiers included account creation and last login times, login counts and the client IP address used during the most recent login. A subset of 43 records also included date of birth, gender, country or region and nickname information.
Capcom distinguishes unauthorised password changes from a confirmed leak of customers’ original passwords. Capcom confirmed that attackers changed the login passwords on 196 accounts, and says it reset those accounts. It has not confirmed that the original passwords chosen by customers were compromised. Account takeover through unauthorised changes is serious, but it should not be reported as proof that Capcom’s entire password database was stolen or decrypted.
The company’s 23 October update gives a more precise description of downstream account access. Of the 196 accounts affected by password changes, 19 had associated e-Capcom account pages accessed. These pages held details including names, addresses, contact information, purchase history and customer-service enquiries. Capcom says the 19 e-Capcom records were in Japan and that credit card details were not among the affected information.
The scale of the primary dataset and the much smaller subsets describe different kinds of exposure. An email-address record can enable targeting through convincing impersonation even when a criminal cannot sign into the account. An account on which the password was changed indicates a different form of control, and access to stored shopping details introduces additional personal information. They should not be collapsed into one claim that every affected customer lost the same data.
Capcom says it blocked unauthorised access on the day it detected the incident, established an internal response team the following day, and reported the matter to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on 21 October. It says emergency measures have been completed and that CAPCOM ID services and games remain available.
The method of access has not been described in sufficient public technical detail to attribute the incident to a particular actor or vulnerability. Capcom says the attack path has been addressed, but the statements do not justify claims that a named criminal group conducted the intrusion or that customer payment information was stolen.
Dray Agha, senior manager, tactical response at Huntress, advised caution about the risks that remain when account-related information is exposed. “We advise all Capcom players to change their account passwords immediately as a basic precaution. Attackers regularly use exposed personal data from gaming breaches to craft convincing phishing messages and steal financial details. Gamers must remain highly vigilant against any unexpected emails asking them to verify their account information.”
That is advice from an external cybersecurity specialist, not Capcom’s finding that the original account passwords were compromised. The company itself warns that stolen contact information may be used to impersonate Capcom or related parties in fraudulent messages, calls and texts. It has established customer-support channels, including services for the Europe, Middle East and Africa region.
Capcom says it has completed its assessment of the consequences of the unauthorised password changes and will continue monitoring accounts and related services. A precise, independently verified account of the original intrusion mechanism has not been released.
