Access to CAPCOM ID, the login players use for Capcom’s web services and for some of its online titles, went to an outside party, the Japanese company said this week. Sign-up owners should treat any fresh message bearing the brand with suspicion.
The alert fired on October 19; confirmation of a break-in arrived the same day. According to the notice, what left the network runs to 11,774,247 account entries globally. Each carried an email address and technical bookkeeping: creation date, time of the most recent login, how many times the account had been used, and the IP address from that last session. A smaller group of 43 entries also lost the owner’s birth date, sex, nickname and country or region.
No password leak, but 196 were swapped
Capcom saw no sign that members’ own passwords came out, and card data stayed out of it. Someone did change credentials on 196 accounts without permission; those have been reset since.
A roster like that is raw material for convincing forgeries sent in Capcom’s name, so owners were told to ignore links and attachments in anything that appears to come from it.
Fast paperwork
Blocking began straight away, an incident command post opened October 20 alongside a briefing to the outside Information Technology Security Oversight Committee, and reports reached Osaka Prefectural Police and the Personal Information Protection Commission a day later. Capcom calls its emergency response complete and says it found and dealt with the intrusion method. Games remain up, support lines are open by region, and no group has claimed the job.
The publisher has been hit before: ransomware in November 2020 touched up to 350,000 people. Rockstar Games confirmed an April intrusion claimed by ShinyHunters.
