Capcom confirmed the exposure of information associated with 11,774,247 records of CAPCOM ID after unauthorized access to the company's account service. The incident was identified on October 19 and disclosed in detail on Thursday (22), with new clarifications published the following day.
The compromised data includes email addresses, account creation dates, last login times, number of accesses, and IP addresses used in the most recent connection.
In 43 records, additional information was also exposed, such as date of birth, gender, country or region, and nickname. The total number disclosed corresponds to affected records, not necessarily distinct people.
196 accounts had their passwords changed and 19 experienced additional access
The investigation identified 196 accounts whose passwords were changed without authorization. Capcom reset those credentials but emphasized that it did not confirm the leak of the passwords originally chosen by users.
In a second statement, published this Friday (23), the company revealed that third parties used 19 of those accounts to access personal pages of the Japanese e-Capcom store.
In those 19 cases, names, phone numbers, addresses, dates of birth, purchase and customer service histories were exposed, as well as information stored in customers' address books. All occurred in Japan.
The company stated that credit card data was not compromised and that it did not identify additional exposure resulting from the password changes in the other affected accounts.
After detecting the incident, Capcom blocked the unauthorized access and reported the case to the Japanese police and the national data protection authority.
The investigation into the extent of the incident was completed, according to the October 23 update. The company will continue monitoring its services and will individually notify affected users.
The operation of the games was not affected. Capcom also warned about possible fraud attempts via email, SMS, or phone using the exposed information and advised users to avoid suspicious links and attachments.
