Capcom discloses leak of data from Capcom ID affecting over 11.7 million accounts

Game developer Capcom announced that its Capcom ID service was subject to unauthorized access by a third party, and that email addresses and “system-specific identifier” information were viewed for a total of 11,774,247 accounts. According to the company, suspicious activity was first detected on October 19, and containment and remediation measures were taken over the following days.

In this breach, 43 accounts reportedly had additional information viewed, such as date of birth, gender, country/region, and nickname. At the same time, Capcom stated that it has not confirmed any leakage of Capcom ID login passwords set by customers, while acknowledging that passwords were changed without authorization for 196 accounts; those passwords have already been reset. Capcom also specified that credit card information was not affected.

Capcom said it has reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission, and that it has identified the attack method and taken countermeasures. The company will continue a detailed investigation and consider measures to prevent recurrence. It also warned users that the leaked email addresses could be used for phishing emails, and advised users not to open suspicious emails or click URLs or attachments in such communications.

Affected services include titles that require online play (for example: Street Fighter 6), and Capcom said it will identify the scope of impact and notify affected users individually. At this time, the company continues to examine the detailed scope of impact and consider additional security measures.