Japanese game developer and publisher Capcom has announced a security breach targeting its unified account service, CAPCOM ID, by a third party, which resulted in the leak of private information associated with more than 11.7 million accounts worldwide. The company confirmed that the incident did not affect users' ability to play games or access multiplayer features.
Details of affected data and scope of the breach
Capcom clarified that the compromised data included email addresses, IP addresses, account activity logs, as well as account creation dates and login information. Despite the scale of the leak, the company confirmed that credit card data and users' financial information were not compromised or altered.
Details revealed by the company indicated that a specific group of users experienced more detailed breaches, as the leak included data for 43 users that contained dates of birth, gender, country/region, and nicknames. Additionally, 193 accounts saw unauthorized changes made to their passwords.
What changes practically for users?
Although the master password database was not leaked, the exposure of email addresses and IP addresses increases the risk of users being targeted by phishing and social engineering attempts. Consequently, this breach entails several practical steps:
- Precautionary password change: All CAPCOM ID users are advised to change their passwords as a safeguard against any leaks that may not have appeared in the initial report.
- Beware of phishing messages: Caution should be exercised when receiving any unexpected emails, and users should refrain from clicking on links or opening suspicious attachments.
- Verify the security of linked accounts: Review other accounts and services that use the same email address to ensure there is no unusual activity.
Remedial actions and Capcom's position
Capcom confirmed that it has managed to identify the method used in the breach and patched the technical vulnerability to prevent a recurrence of the incident. It has also begun communicating directly with affected users to provide the necessary technical support. This incident highlights the ongoing targeting of major gaming companies, as unified account platforms have become a primary target for cyberattacks seeking to collect and exploit personal data.