Capcom: 11,774,247 CAPCOM ID accounts leaked worldwide in unauthorized access; 196 accounts had passwords changed

According to Capcom's announcement, the incident was caused by unauthorized access to the membership service "CAPCOM ID." Investigation results found that parts of the registered user information were leaked, totaling 11,774,247 records worldwide. The leaked information includes email addresses and login timestamps, as well as profile items such as date of birth, gender, country, region, and nickname.

Of particular concern is that unauthorized password changes by third parties were confirmed for a subset of accounts (196 accounts). Accounts whose passwords were changed may prevent the legitimate users from logging in. The company says it has completed emergency countermeasures and that services using CAPCOM ID remain available, with no impact on gameplay.

The company is urging users to (1) change their CAPCOM ID password if they reuse the same password on other services, and (2) promptly change their password and contact support if they receive login or password change notifications they do not recognize.

Combinations of email addresses with information such as birthdate or name are easily abused as material for targeted phishing emails or account takeover. This incident, which targeted the membership base of a company that holds major game titles, can be seen as an example of cyberattacks focusing on the entertainment sector. We should await further disclosures from the company regarding the full scope of the damage and the route of the unauthorized access.