Capcom confirms breach of 11.7 million accounts

Capcom said unauthorised access to its CAPCOM ID service exposed data from more than 11.7 million accounts. The information included email addresses, account creation dates, last login times, login counts and the IP address used most recently.

For 43 accounts, the exposed material also included dates of birth, gender, nicknames and countries. In 196 accounts, the intruders changed login passwords in what Capcom described as an attempt to block owners out, and the company reset them.

Capcom said passwords for all other registered members were not exposed and that credit card data was not affected. It detected suspicious activity on 19 October and confirmed the unauthorised access that day.

The company said it began an investigation immediately and that by 20 October it was clear customer information had been compromised. On 21 October, it reported the incident to police and to Japan’s Personal Information Protection Commission.

Capcom said its online services were unaffected and that it would notify affected customers in stages. It also said it had identified the intrusion method and put security measures in place, but gave no further details.