Japanese gaming company Capcom has disclosed a major security breach affecting its Capcom ID service, which it says exposed information from more than 11.7 million accounts worldwide. The company said it has moved quickly to halt the access and is still assessing the full impact.
What data was exposed from Capcom accounts
Capcom said 11,774,247 email addresses were leaked. Exposed account details also include creation dates, last login dates, login counts and the IP address used for the most recent login. For 43 accounts, the data extended to birth dates, gender, country or region and nicknames.
Passwords reset and payment data kept safe
The intrusion led to unauthorized password changes on 196 accounts, which Capcom has since reset. The company said there is no evidence that customers’ original passwords were leaked. Credit card information was not part of the compromised data.
Timeline of detection and reporting to authorities
Capcom said it first saw signs of unauthorized access on October 19 and began blocking the activity. The next day, it set up an internal task force. By October 21, the company had reported the incident to police and Japan’s Personal Information Protection Commission.
Capcom is contacting affected customers and has warned users to be wary of suspicious emails. Because so many addresses were exposed, attackers could use the stolen information in phishing attempts that appear to come from Capcom or related companies.
