Capcom’s breach disclosures put the exposed CAPCOM ID records at 11.7 million, mostly email addresses, but a much smaller number points to the more direct harm. Of the 196 CAPCOM ID accounts whose passwords an intruder changed, 19 were then used to reach customers’ account pages on e-Capcom, the company’s online store in Japan, where names, phone numbers, addresses, birth dates, purchase histories and saved address books were affected.
Capcom laid that out in an update dated Oct. 23, a day after its first notice said CAPCOM ID, the unified account players use for Capcom web services and to play some of its games online, had been “subject to unauthorized access by a third party.” Engadget, which reported the breach to U.S. readers on Saturday, focused on the phishing risk for the wider user base and noted that Street Fighter 6 needs the account for online play.
What the 11.7 million records actually contain
The big tally is 11,774,247 records worldwide. Each holds an email address plus what Capcom calls system-specific identifiers: when the account was created, when it last logged in, how many times it has logged in and the IP address used for that last login. Only 43 records also included birth date, gender, country or region and nickname. Credit card information was not included, the company said.
Capcom’s notices warn that the data could be misused in fraudulent emails, texts or calls impersonating the company, and they tell customers not to open links or attachments in suspicious messages.
How Capcom says it unfolded
The company said it “detected suspicious activity indicating potential unauthorized access” on Oct. 19, blocked it and confirmed the same day that an intrusion had happened. It set up an incident response headquarters on Oct. 20 and reported the case to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on Oct. 21. Capcom said it has “identified and addressed the attack method,” but it hasn’t said what that method was or how the passwords were changed.
Because CAPCOM ID is a single login for several Capcom services, the password resets gave the intruder a way into those 19 store accounts. In the Oct. 23 update, Capcom said it found no other leaks tied to the password changes and that “the investigation into the scope of the impact from this incident has been completed.”
In 2020 a ransomware attack hit Capcom’s network, and Capcom found a message from a group calling itself Ragnar Locker on affected devices. The company’s final report in April 2021 traced the entry point to “an older backup VPN” device left running at its U.S. subsidiary. That case led Capcom to form the Information Technology Security Oversight Committee, the outside advisory body Capcom said it notified on Oct. 20.
Earlier on Saturday, WebProNews reported that GMO Internet asked Tokyo to use its new cyber defense powers after a breach of its Onamae.com Desktop Cloud service. Capcom says it will notify affected customers, and it runs a toll-free support line in Japan, 0120-801-271, from 10 a.m. to 8 p.m. local time.
For 19 Capcom Customers, a Hijacked Game Login Also Opened Their Shopping Accounts first appeared on Web and IT News.