Capcom has disclosed a data breach of its online membership account service affecting over 11 million customer accounts, warning customers to brace themselves for potential phishing attempts.
The Resident Evil, Monster Hunter, and Street Fighter developer said customer information associated with Capcom ID was accessed by a third-party on October 19. 11.7 million email address records were affected globally, exposing date and time of account creation, date and time of last login, number of logins, and the client IP address used during last login.
Of these, 43 records of date of birth, gender, country/region, and nickname were affected, and 196 accounts saw unauthorized changes to their Capcom ID login passwords. Capcom said the passwords associated with these accounts have already been reset, as it “continues to investigate the scope of any impact resulting from this incident.”
While the data breach is damaging, Capcom insisted passwords customers created themselves were not leaked, and credit card information was not included among the affected information. It does not expect its video games to be affected.
Capcom said it reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. It told customers they may continue to use the email addresses registered with Capcom ID, but warned that there is the possibility that the affected information could be misused to send fraudulent emails.
“If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files,” Capcom advised.
Capcom didn’t go into detail on how it was hacked, but said it had completed emergency response measures and had “identified and addressed the attack method involved in this incident.”
“Capcom takes this matter extremely seriously and will continue its detailed investigation,” the company concluded.
“Based on the findings of the investigation, it will implement measures to prevent recurrence and further strengthen its information security framework. Should any additional facts requiring disclosure be identified, Capcom will promptly provide updates through the company’s official website and other appropriate channels.
“Capcom would once again like to express its sincere apologies to its customers and all other stakeholders.”
Photo by Oliver Berg/picture alliance via Getty Images.
Wesley is IGN’s Managing Editor. Find him on Twitter at @wyp100. You can reach Wesley at wesley_yinpoole@ign.com or confidentially at wyp100@proton.me.
