Capcom confirmed a data leak incident that affected over 11.7 million accounts associated with CAPCOM ID, the system used to access the company's online services. The incident was detected on October 19 and resulted in the exposure of email addresses and other user data.
According to a statement issued by the Japanese developer on Thursday (22), the intruders gained access to the registration data and usage records of these accounts. Capcom is known for developing popular franchises such as Resident Evil, Monster Hunter, Street Fighter, and Mega Man.
The compromised information includes email addresses, account creation dates, timestamps of the most recent accesses, the number of logins performed, and the IP addresses used in the latest connections. Additionally, in 43 specific accounts, more detailed data was exposed, such as date of birth, gender, nicknames, and residential locations.
In another 196 cases, the intruders proceeded to change the CAPCOM ID access passwords, which appears to have been done with the intention of preventing owners from regaining control of their accounts. Capcom reported identifying this situation and has already proceeded to reset these credentials.
The company assures that the passwords of other users were not exposed and that no credit card information was compromised. After noticing suspicious activity on October 19, Capcom initiated an investigation and confirmed the unauthorized access to user information the following day.
The incident was reported to both the Japanese police and the Personal Information Protection Commission of Japan on October 21. The company stated that the method of intrusion has been identified and that new security measures have been implemented, although technical details about the attack have not been disclosed.
Although Capcom's online services remain operational normally, the company advises players to be cautious of unexpected messages, suspicious links, and requests for personal data, given that the email leak can enhance phishing attempts.
Capcom will communicate with affected users gradually and provide specific support channels for each region. This is not the first security issue faced by the Japanese developer; in November 2020, it was victimized by a ransomware attack attributed to the Ragnar Locker group, potentially affecting up to 390,000 people, when it was discovered that the intruders used old VPN equipment to enter the corporate network.