Capcom confirms data breach affecting 11.7 million users with emails and personal details exposed

Capcom has confirmed a data breach affecting 11,774,247 user accounts through its CAPCOM ID online membership service. The company issued a public apology, stating that "unauthorised access by a third party occurred to our online membership service 'CAPCOM ID', resulting in the leakage of some customer information."

The breach exposed email addresses alongside system-specific identification information including account creation time, last login date, and client IP address on last login. A smaller subset of 43 accounts had additional personal details exposed, including date of birth, gender, country or region, and account nickname.

Capcom reported that 196 accounts had their login passwords illegally changed, though the company confirmed "No leaks of passwords set by the customers themselves have been confirmed". The affected account passwords have been reset and the company continues investigating the breach's full scope.

No credit card information was included in the breach. Capcom discovered the unauthorised access on October 19 and blocked further access immediately. A task force was created on October 20, and the breach was reported to police and the Personal Information Protection Commission on October 21.

Capcom has completed emergency security measures and identified the attack methods used. The company urges affected users to watch for suspicious emails impersonating Capcom or similar organisations that could attempt account access or phishing. Users are advised to use unique passwords across different accounts and consider using a password manager.