Capcom has confirmed a sizeable data breach, and the most useful thing you can do about it costs nothing: be suspicious of emails that say they're from Capcom. In an investor-relations notice dated 22 October, the company said an unauthorised third party had accessed its CAPCOM ID membership service, exposing 11,774,247 records worldwide.
Capcom's wording is precise, and it's worth keeping it that way. It describes the figure as records, not people. Those records are mainly email addresses and system data tied to them. BleepingComputer, which reported the notice the same day, describes the exposed information as more than 11.7 million customer email addresses with their associated details.
What was exposed, and what wasn't
According to Capcom, the bulk of the exposure is email addresses plus account metadata: when the account was created, the last login time, the number of logins, and the IP address used at the last login.
A much smaller group fared worse. For 43 records, Capcom says date of birth, gender, country or region and nickname were also exposed. And for 196 accounts, the attackers changed the login password without permission. BleepingComputer suggests the aim was to lock owners out. Capcom says it has reset those passwords.
Now the reassuring part, in Capcom's own framing. The company says it has not confirmed any compromise of the login passwords customers set themselves, and that credit card information was not affected. It also says it has identified and addressed the method the attackers used, though it hasn't said what that method was.
How it unfolded
Capcom gives a short timeline:
- 19 October: suspicious activity detected, and unauthorised access confirmed the same day.
- 20 October: Capcom confirmed that customer information had been accessed and that some passwords had been changed.
- 21 October: the incident was reported to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission.
Capcom doesn't say when the unauthorised access began. BleepingComputer notes the timing of the breach remains unclear, and that Capcom plans to notify affected customers in stages, with region-specific support channels for questions.
What to do if you have a CAPCOM ID
The biggest risk now isn't your password. It's your inbox. Capcom itself warns that the exposed email addresses could be used for fraudulent messages impersonating the company, and advises against opening links or attachments in anything suspicious.
A few sensible steps, as advice rather than anything Capcom requires:
- Treat "Capcom" emails with suspicion for a while, especially anything asking you to log in, confirm details or open an attachment. Go to Capcom's sites directly instead of clicking through.
- Change your password if you reuse it. Capcom says customer-set passwords weren't compromised, but if your CAPCOM ID password is used anywhere else, changing it is cheap insurance.
- Watch for Capcom's own notification. The company says it will contact affected customers, and its notice lists support contacts by region.
This is also not Capcom's first breach. BleepingComputer points to an earlier incident, which Capcom disclosed details of in April 2021. For now, Capcom says its online services are unaffected, and it hasn't said anything further about the attack method or who was behind it.
Reporting notes