On this page · 4 sections ▾
Capcom confirmed in the week of October 19 that a third party gained unauthorized access to Capcom ID, its online membership service, exposing data tied to more than 11.7 million users. Per TechRadar, published October 23, the attackers obtained 11,774,247 email addresses. Capcom says credit card information was not affected.
Key facts
- Capcom says it detected suspicious activity on October 19, blocked access and began investigating, according to Engadget.
- Exposed for all affected accounts: email addresses, account creation time, last login time, login count and the client IP at last login, per TechRadar.
- For 43 accounts, attackers also obtained birth dates, gender, nicknames, and country or region.
- Attackers changed passwords on 196 accounts. Capcom says the passwords themselves were not leaked and the accounts were restored to their owners.
- Capcom ID and the games that depend on it, including Street Fighter 6, remain available.
What Capcom has said
Capcom says it identified and addressed the attack method, reported the incident to local police and notified its external advisory board for security oversight, as Engadget reports. It plans to contact eligible customers individually. TechRadar notes the company apologized in a security advisory on its Japanese site, and that the investigation continues.
The company has not disclosed who was behind the attack or how they got in. TechRadar points out that this leaves open whether stolen employee credentials or a software vulnerability was involved, and whether any extortion attempt took place. No threat actor had claimed responsibility on the dark web at the time of its report, and no samples or full database had been shared.
Why it matters
Email addresses alone are a limited exposure, but they are useful for targeted phishing. Both outlets say Capcom is urging users to be wary of unexpected messages, particularly any that reference the company. Engadget notes the leaked data could be used to send scam emails impersonating Capcom.
The login metadata adds some risk. Knowing when a person last signed in and from which IP address could make a fake message more convincing, though neither outlet says this data has been misused.
The 196 forced password changes suggest the attackers were able to act on accounts, not only read data. TechRadar describes this as an apparent attempt to lock owners out. Capcom's statement that it restored those accounts is the only remediation detail given so far.
Background and what to watch
This is not Capcom's first incident. TechRadar recounts that in November 2020 the Ragnar Locker ransomware group took roughly a terabyte of data, and that the company later said attackers entered through an old VPN device, affecting 390,000 people. Engadget adds that Rockstar Games confirmed a third-party data breach in April.
Things to watch: whether Capcom discloses the attack method, whether any group claims the breach or leaks data, and whether the individual notifications to eligible customers expand the scope. Capcom ID users can treat unsolicited emails that mention the company with caution until then.