Japanese game publisher Capcom has confirmed that attackers broke into CAPCOM ID, the shared account used for its web services and some online games, and took customer information. In its notice, Capcom says 11,774,247 accounts worldwide had their email address and system identifiers exposed: account creation date, last login time, number of logins and the IP address from the last login.
For 43 of those accounts, dates of birth, gender, country or region and nickname were also exposed. In another 196 accounts, the attackers changed the CAPCOM ID password, in what BleepingComputer describes as an attempt to lock the owners out; Capcom says it has already reset those. It says the passwords customers set themselves were not found to be exposed, and that credit card information was not part of the breach.
Capcom says it found signs of unauthorized access on October 19, confirmed the intrusion that day, and found by October 20 that customer data had been taken. It reported the incident to police and Japan’s Personal Information Protection Commission on October 21. Capcom says it has identified how the attackers got in and fixed it, and that games and CAPCOM ID services are unaffected, though BleepingComputer notes no details of the initial access were shared. Capcom will notify affected customers in stages and has set up region-specific support channels.
How to check if you’re affected
Affected products are CAPCOM ID accounts. Capcom says it will contact affected customers individually, so watch for an email from the company and use the support channels in its notice (Japan, the Americas via Capcom USA Customer Support, and EMEA via Capcom Europe) if you have questions.
Capcom’s own advice is to be careful with unsolicited messages: the exposed email addresses could be used for emails that impersonate Capcom or related companies. Capcom asks customers not to open links or attachments in suspicious emails.