Capcom says an unauthorized third party accessed more than 11.7 million records tied to its Capcom ID online account service, exposing email addresses and account data worldwide.
The incident affected 11,774,247 Capcom ID records, which contained email addresses and information such as account creation dates, last login times, the number of logins and the IP address used for the last login. Capcom ID is required to play certain Capcom games online.
Capcom said 43 of the records also contained dates of birth, genders, countries or regions and nicknames.
Passwords changed on 196 accounts
Some accounts also had their passwords changed. Capcom said it has not confirmed any compromise of Capcom ID login passwords originally set by customers themselves, but it confirmed that passwords were changed without authorization on 196 accounts. Those passwords have been reset.
In an update, Capcom said the intruder also accessed the e-Capcom online store pages of 19 of those accounts in Japan. The affected information included names, phone numbers, addresses, dates of birth and purchase histories. Credit card information was not affected.
Company detected suspicious activity on October 19
Capcom said it spotted the suspicious activity on October 19 and began blocking it the same day. It reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21.
The company said its games and other services remain available and that it will contact affected customers. Capcom also warned users to watch for fake emails or messages pretending to be from the company.
“If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files,” Capcom said.
