Players who signed up for Capcom’s online account service may want to look twice at emails that seem to come from the company.
The company has disclosed that a third party gained unauthorized access to customer information linked to CAPCOM ID, the account people use to sign in to the company’s web services and to play some of its games online. It detected suspicious activity on October 19 and confirmed the intrusion the same day.
Capcom is the Japanese video game developer and publisher famous for Resident Evil, Street Fighter, Monster Hunter and Mega Man.
According to Capcom’s notice, the attackers got hold of 11,774,247 records worldwide containing email addresses along with system data about each account, including when it was created, the time of the last login, the number of logins, and the IP address used for the most recent sign-in.
For 43 of those records, the exposed data also included the account holder’s date of birth, gender, country or region, and nickname.
Capcom says it has found no evidence that passwords set by customers were compromised. The attackers did, however, change the passwords on 196 accounts without authorization, and the company has since reset them. Payment card information was not among the affected data, the company noted.
Email addresses registered with CAPCOM ID can still be used, the publisher said, though the stolen information could be used to send fraudulent messages posing as Capcom or related parties. Users who receive a suspicious email or message are asked to “refrain from accessing any URLs contained therein or opening any attached files.”
After spotting the activity, Capcom began blocking the access and worked to identify the method of attack.
On October 20 it set up an internal incident response headquarters and informed the Information Technology Security Oversight Committee, an external body that advises the company. A day later, it reported the incident to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission.
The company says it has completed its emergency response and identified and addressed the attack method, without describing it, and that CAPCOM ID services and its games remain available.
Capcom plans to notify affected customers and has opened dedicated support channels by region, including a toll-free line in Japan and online inquiry forms for players in the Americas and in Europe, the Middle East and Africa.
Its investigation is ongoing, and the company has said it will publish updates on its website if it finds further information that needs to be disclosed.
At the time of writing, no group has claimed responsibility for the attack.
This is not the first time Capcom has dealt with a cyberattack. In November 2020, the company suffered a ransomware attack that compromised the personal information of up to 350,000 customers, business partners and employees.
Capcom is not the only game company to report a cyberattack this year, with Rockstar Games, the developer of Grand Theft Auto and Red Dead Redemption, confirming an attack in April claimed by the ShinyHunters group.
