Capcom and Square Enix have become the latest major video game companies to suffer from online attacks, with both companies confirming unauthorized access to player data. These incidents occur amidst a broader trend of increased cybersecurity breaches targeting Japanese corporations, many of which are reportedly powered by artificial intelligence.
Square Enix confirmed on October 19 that a number of accounts for its massively multiplayer online role-playing game, Final Fantasy XIV, had been accessed by a third party. The company stated that this breach was not a result of a direct compromise of Square Enix's own systems. Instead, attackers used credentials obtained from security breaches at other companies to gain access to Final Fantasy XIV accounts. Square Enix has implemented measures to protect potentially compromised accounts and indicated that further security actions, such as mandatory password resets, may be enforced if such breaches continue.
Capcom, meanwhile, disclosed that a direct breach of its databases and services had occurred, leading to unauthorized access to system-identifying account information and email addresses for over 11.7 million users. In a significant portion of these cases, including at least 43 instances, sensitive personal information such as date of birth, gender, and location was accessed. Furthermore, passwords were illegally altered on approximately 196 accounts. Capcom identified and fixed the vulnerability internally on October 19, the same day the breach occurred. An investigation into the cause is underway, with all findings being reported to the police.
These incidents are part of a growing wave of cybersecurity breaches affecting Japanese companies across various sectors. The Japanese government is reportedly examining strategies to combat the increasing number of data leaks, with the total number of breaches in the current year already surpassing that of the previous year. Reports suggest that AI systems are playing a significant role in powering many of these attacks.
These events serve as a stark reminder for players to maintain strong, unique passwords across different online services and to update them regularly. Enabling two-factor authentication, where available, is also crucial for enhancing account security and preventing compromised data from one service being used to access others.