Capcom ID Breach Hit 11.77m Email Records

An attacker got into the customer data behind CAPCOM ID, Capcom’s online account system, and the company says the exposed data covers 11,774,247 email address records worldwide. In a statement on 22 October, the Japanese games company said the attacker also changed the login passwords of 196 accounts. Capcom says it has reset those passwords and that credit card information was not affected.

The figure is a count of records, not of people, and Capcom has not said how many individual customers it covers. What it has made clear is the scale of a service that many players need: CAPCOM ID is required to play some Capcom games online. The company says its games and services have kept running throughout.

TSN tracks incidents like this on its ransomware and cyber attacks hub.

Most of the 11.77 million records hold an email address and login data

According to Capcom, the 11,774,247 records contain email addresses plus account data: when each account was created, when it last logged in, how many times it has logged in, and the IP address used for the last login. Only 43 of those records also included date of birth, gender, country or region, and nickname.

The password changes are the most direct harm Capcom describes. It says it “has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves”, but found that passwords on 196 accounts had been changed without permission. It has not explained how that was done.

Capcom’s timeline is short. It says it spotted suspicious activity on 19 October and confirmed the unauthorised access the same day. It set up an internal incident headquarters on 20 October, and on 21 October reported the breach to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission. The company says it “has identified and addressed the attack method” but has not said what it was, or who was behind it. No group has publicly claimed the attack.

The Japanese original is blunter than the English

Capcom’s English statement is a translation, and the company says the Japanese original prevails if they differ. They do differ in tone. The English says customer information “was subject to unauthorized access by a third party”. The Japanese says part of that information was found to have leaked outside the company (外部に漏えい). For anyone weighing the risk, the Japanese version is the one Capcom stands behind.

Capcom warns customers that the stolen details could be used to send emails or messages pretending to come from Capcom or related parties. It says it will contact affected customers, and it has set up dedicated support channels, including an inquiry form for players in Europe, the Middle East and Africa through Capcom Europe.

An email list with login history is a phishing kit

This breach has no passwords or card numbers to steal, but it is still useful to an attacker. An email address tied to a known gaming account, plus the date of the player’s last login, is exactly what a convincing phishing message needs. A fake “your CAPCOM ID was accessed” email lands better when the recipient knows the breach is real, and Capcom has said as much in its own warning. The 196 password changes are a small number, but they show the attacker was not limited to reading data.

The count also needs care. Capcom chose the word “records”, and gave no figure for individual customers, so the 11.77 million cannot be read as a count of players or compared directly with a population figure. One person may hold more than one record, or none may be active; Capcom has not said. It sits close to Burger King Japan’s 11.18 million app member records disclosed last week, another case where a record count was the only measure given.

Capcom is the latest in a run of Japanese companies to disclose breaches of membership systems this autumn. They include Hankyu Hanshin’s H2O ID and the cases collected in TSN’s round-up of Japan’s data-breach wave, as well as an incident at Arcadia that may have exposed data on Japanese police staff. Capcom told police and the privacy regulator within two days of spotting the attack, but has said little about how the attacker got in.

The questions now are the ones Capcom left open: how 196 passwords were changed when customers’ own passwords were not exposed, and how many people sit behind the 11.77 million records. It has promised to publish further facts on its website as its investigation continues.