Capcom has confirmed a significant data breach affecting its Capcom ID service, with unauthorized access leading to the exposure of information belonging to over 11.7 million individuals worldwide. The company issued a public apology detailing the incident, which it first detected on October 19.
According to Capcom, the breach primarily involved system-specific identification information, including account creation dates, last login times, and the client IP addresses associated with those logins. While the email addresses of 11,774,247 users were compromised, Capcom stated that passwords set by users were not leaked. However, the login passwords for 196 Capcom accounts were illegally changed, prompting the company to reset those passwords and initiate an investigation into the extent of the unauthorized access.
In addition to email addresses and login data, personal details from 43 accounts were also exposed. This included dates of birth, gender, country or region, and nicknames associated with the accounts. Capcom has assured that no credit card information was accessed in the breach.
Capcom has implemented emergency measures to address the attack and identify the methods used. The company has reported the incident to the police and the Personal Information Protection Commission. Affected users will be notified via email, and Capcom urges them to remain vigilant against potential phishing attempts or suspicious communications that may impersonate the company or similar entities.
Capcom advises users to be cautious of any emails that seem to be impersonating the company or other businesses in an attempt to gain account access or phish for information. While user-created passwords were not compromised, the incident serves as a reminder for users to maintain strong, unique passwords across all their online accounts and consider using a password manager for enhanced security.