Capcom Confirms a Data Breach Affecting 11.7 Million CAPCOM ID Records

Capcom has confirmed that someone broke into its CAPCOM ID account service and accessed information tied to more than 11.7 million records. CAPCOM ID is the account Capcom players use for its web services, and it’s required to play some Capcom games online, including Street Fighter 6.

What was taken

According to Capcom’s official notice, the breach exposed:

• 11,774,247 records worldwide with email addresses and system details: when the account was created, the last login date and time, the number of logins, and the IP address used for the last login.
• 43 records that also included date of birth, gender, country or region, and nickname.
• 196 accounts whose passwords were changed without authorization. Capcom says it has already reset those passwords.

Capcom says it has not confirmed that any passwords customers set themselves were stolen, and that credit card information was not part of the affected data.

What Capcom has done

Capcom says it detected suspicious activity on October 19, immediately started blocking the access and confirmed the same day that unauthorized access had happened. It set up an internal incident response team, reported the incident to the police and its external security advisory board, and says it has identified and addressed the method the attackers used. CAPCOM ID and every service that relies on it remain available, and the incident doesn’t affect anyone’s ability to play Capcom games. Capcom says it will notify affected customers.

What you should do

The biggest risk now is phishing. Capcom warns that the leaked email addresses could be used to send scam emails pretending to be from Capcom. Be suspicious of any message about your CAPCOM ID that asks you to click a link, sign in or share personal details, and go to Capcom’s website directly instead. If you reuse your CAPCOM ID password anywhere else, changing it on those sites is a good precaution, even though Capcom hasn’t found evidence that customer passwords were stolen.

Capcom isn’t the only game company dealing with this lately: Engadget notes that Rockstar Games confirmed a third-party data breach in April. Earlier this month, we also covered how Capcom plans to use AI in game development.

The bottom line

The Capcom breach mostly exposed email addresses and login details rather than passwords or payment information, but with 11.7 million records involved, expect a wave of fake “Capcom” emails. Don’t click links in them, and change any reused passwords.

Sources: Capcom, Engadget