Capcom says breach exposed contact and login data for 11.7 million CAPCOM ID accounts
Passwords for most members and card data were not exposed, but users whose logins were exposed should watch for phishing and changes to their accounts.
Japanese publisher Capcom says intruders reached its CAPCOM ID account service and exposed email addresses and login metadata for more than 11.7 million customers. For 43 accounts, birth dates, gender, nicknames and countries were also visible, while 196 accounts had their passwords changed by attackers before Capcom reset them. Capcom says passwords for other members and credit card data were untouched, and that its online services still work. The company detected the activity and confirmed unauthorized access on October 19, reported it to police and Japan's privacy regulator on October 21, and will notify customers in stages. For developers and operators, the case shows how a shared login system can expose a large user base even when payment data stays protected.
Why it matters
For players of Capcom's games, the breach means their email address, account dates and last-login details may be in attackers' hands, even though payment card data and most passwords were not exposed. The 196 accounts whose passwords were changed by attackers show the intrusion was used to try to lock owners out, so affected users have reason to check their accounts. Capcom says it will notify customers in stages, so the full picture of who is affected may take time to emerge.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- BleepingComputer