Capcom confirms CAPCOM ID breach exposing 11.77 million email records

Capcom has confirmed that an unauthorized third party accessed customer information tied to CAPCOM ID, its online membership account service, exposing 11,774,247 email address records worldwide, or about 11.77 million.

What was exposed. Each affected record included an email address along with the account creation time, last login time, login count and the IP address used at the last login. Of those, 43 records also exposed date of birth, gender, country/region and nickname.

In 196 accounts, login passwords were changed without authorization. Capcom says the passwords for those accounts have already been reset. The company said it has not confirmed any leak of passwords customers set themselves, and credit card information was not included.

Timeline. Capcom detected suspicious activity on October 19 and confirmed unauthorized access that day. On October 20 it confirmed that customer information had been accessed and that some passwords had been changed. On October 21 it reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.

Services that use CAPCOM ID, including games, remain available. Capcom says it has identified and addressed the attack method, will notify affected customers in stages, and has set up regional support channels.

Watch for phishing. Capcom warned that the data could be used for fraudulent emails impersonating the company and urged customers to exercise caution with any suspicious email or message and not access URLs or open attachments in them. It has not said how the attackers got in.