Capcom Data Breach Exposes 11.7 Million Email Addresses

Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service.

Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and games. As of October 22, attackers stole 11,774,247 email addresses, along with account details including creation dates, last login dates, login counts, and the IP addresses used for the latest logins.

“We have recently discovered that unauthorized access by a third party occurred to our online membership service “CAPCOM ID”<br>(*1) , resulting in the leakage of some customer information.” reads the company’s notice. “Number of leaked email addresses and system-specific identification information: 11,774,247 (worldwide total)”

In 43 cases, hackers exposed date of birth, gender, country/region, and nickname. Capcom also reported that attackers illegally changed passwords on 196 accounts, and the company has already reset them. The company said the incident exposed personal information belonging to a small number of individuals.

Capcom has activated its incident response procedures and confirmed that services using CAPCOM ID remain operational. The company has notified the relevant authorities, is investigating the breach, and has begun contacting affected customers through a dedicated support channel.

The company also urges users to watch out for phishing attempts involving emails impersonating Capcom or its partners, particularly those containing suspicious links or attachments. It says it will investigate the incident, address the identified causes, and strengthen its security measures to prevent similar breaches.

“In response, we implemented emergency measures and began identifying and addressing the attack method.” states the notice.”A task force was established within the company to gather information and take measures to prevent further damage. The investigation revealed that some customer information registered with “CAPCOM ID” had been leaked. In addition, unauthorized password changes were confirmed for some accounts. On the same day, the incident was reported to the Security Oversight Committee, our external advisory organization.”

Capcom was previously targeted by the Ragnar Locker ransomware gang in November 2020. The attackers claimed to have stolen 1 TB of data, potentially affecting up to 390,000 people.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)