Capcom confirms the theft of data from 11.7 million CAPCOM ID records and access to 19 accounts in its store

Capcom has completed the investigation into the scope of the Password changes detected after unauthorized access to CAPCOM ID. Of the 196 accounts affected by these modifications, a third entered the personal page of 19 users of the Japanese e-Capcom store and obtained additional information. The update, published on October 23, expands on the company’s first notice, which had already confirmed the exposure of 11,774,247 records worldwide.

The emails and access data of 11,774,247 records were exposed

CAPCOM ID is the common account that allows you to access the company’s web services and play certain titles online. According to the first statement, published on October 22, unauthorized access exposed 11,774,247 records of email addresses and data associated with the operation of the accounts. It is a global number of affected records; The notice does not provide a breakdown by country or specify how many different people they represent.

Along with the email, the date and time of account creation, the date and time of the last login, the number of accesses and the IP address used in the most recent login were exposed. This data can help a fraudulent message directed at the owner appear more convincing.

The company identified 43 other recordsincluded in the general figure, which also included date of birth, sex, country or region and nickname. The statement does not detail whether these 43 records coincide with some of the accounts whose password was altered or with the 19 linked to e-Capcom. Therefore, the amounts should be read as different levels of affected information and not as independent groups that can be added.

They changed 196 passwords without permission and accessed 19 store accounts

The investigation detected that a third party changed the password of 196 CAPCOM ID accounts without authorization. Capcom has already reset the credentials for those accounts. The company has not confirmed that the original passwords chosen by their owners were leaked. The improper change of a password demonstrates an alteration of the account, but does not by itself allow us to conclude that the attackers knew the previous password.

The second notice specifies the effect that these changes had. Of the 196 accounts, 19 were used to enter the “My Page” section of e-Capcom, the company’s online store. These 19 cases correspond to Japan. There, the name and its transcription in Kana, the telephone number, the postal code, the address, the sex, the date of birth, the purchase history, the queries made to e-Capcom and the addresses saved in the account book were exposed.

According to the company, the investigation into the effects of the password changes has ended and no information leak caused by these changes has been detected in the other accounts.

Capcom detected the access on October 19 and keeps its games operational

Capcom found signs of suspicious activity on October 19. That same day it began blocking access and confirmed that an unauthorized entry had occurred. On October 20, it formed an internal team to investigate the incident and verified both CAPCOM ID data exposure and password alterations. On the 21st he reported the case to the Osaka Prefectural Police and the Personal Information Protection Commission of Japan.

The company says it has identified and addressed the attack method and has completed urgent measures. He has not publicly explained how the third party managed to enter.so attributing the intrusion to a specific vulnerability, reused passwords, or a specific technique would be speculative. After closing the investigation into the impact of password changes, Capcom continues to monitor CAPCOM ID and related services.

CAPCOM ID accounts are still available and The company assures that the incident does not prevent playing any of its titles. Capcom has indicated that it will contact those affected individually and has enabled support channels. The continuity of the service does not reverse the exposure of information already produced.

The company’s main warning refers to communications that impersonate your identity or that of related entities. The second notice expressly mentions text messages, phone calls and emails. The company asks not to open attachments or access links included in suspicious messages. If you receive a notification about the account, it is advisable to go directly to the official website instead of using the link in the message. European users can go to the Capcom support channels indicated in their official notice to verify any questions about their case.