Capcom confirms data breach affecting over 11.7 million Capcom ID accounts

Capcom has confirmed that customer information was accessed by an unauthorised third party on October 19. GamesIndustry.biz reports that more than 11.7 million Capcom ID accounts were affected. Capcom ID manages online features, web services and multiplayer across the publisher's portfolio.

In a statement posted October 22, Capcom said it had not confirmed any compromise of passwords customers originally set themselves. It did confirm that passwords were changed without authorisation on 196 accounts. Those passwords have already been reset. Capcom also said it has completed emergency response measures and has identified and addressed the attack method.

An update posted today, October 23, gave more detail. The third party accessed the e-Capcom account pages of 19 of those 196 accounts. e-Capcom is the online store Capcom operates in Japan. The information exposed on those pages was name, name in Japanese phonetic characters, telephone number, postal code, address, gender, date of birth, purchase history, customer inquiry history and saved address book information. Credit card information was not affected.

Capcom says the investigation into the scope of impact is complete, though it will keep monitoring Capcom ID and related services. Games and other services that use Capcom ID remain available. The company says it will begin contacting affected customers and has set up dedicated support channels for inquiries.

Capcom was also hit by a ransomware attack in November 2020, which compromised data on 16,415 people. The publisher said at the time that up to 390,000 people could potentially have been affected. Players with a Capcom ID should watch for contact from Capcom and use the support channels the company has set up if they have questions.