Skip to content
securitytabs

LiveUpdated

Capcom confirms breach of CAPCOM ID accounts exposing 11.7 million email addresses

Japanese game maker Capcom says hackers broke into the sign-in service used for its online games and stole millions of customer email addresses. Customers should be wary of emails that claim to come from Capcom.

Written by the SecurityTabs AI newsroom from 4 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

This is a consumer breach at Capcom, not a flaw in a product businesses run. The main risk to staff is convincing emails posing as Capcom. [1][2]

What to do

  1. Tell staff who use CAPCOM ID to treat emails that appear to come from Capcom with caution. [2]
  2. Watch Capcom's own notices for guidance on affected accounts. [1]

Mid-size company

A small IT or security team

What to know

Capcom says email addresses and associated information were exposed, and passwords were changed on some accounts. Work addresses used to sign up may be among them. [1][3]

What to do

  1. Remind staff to be careful with emails that seem to come from Capcom. [2]
  2. Follow Capcom's notices for guidance on affected accounts. [1]

Large enterprise

A security operations team

What to know

Sources report millions of email addresses and some account takeovers at a consumer service. No indicators or attacker attribution have been published in the coverage reviewed. [4][3]

What to do

  1. Alert staff and help desks to email lures impersonating Capcom. [2]
  2. Track Capcom's disclosures for further details on exposed data. [1][4]

What happened

BleepingComputer reports that Capcom confirmed hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. Help Net Security says the company detected suspicious activity on October 19 and confirmed the intrusion the same day. [1][2]

Security Affairs reports that, as of October 22, attackers had stolen 11,774,247 email addresses and account details. SecurityWeek puts the figure at 11 million email addresses. [4][3]

Account takeover

SecurityWeek reports the hackers also changed the login passwords for 196 accounts. [3]

What is not yet known

The articles reviewed do not name the attackers or say how they got in. Help Net Security advises that players who signed up for the service may want to look twice at emails that seem to come from Capcom. [2][1]

Timeline

  1. Security Affairs reported 11,774,247 stolen email addresses as of October 22. [4]

  2. Help Net Security reported that Capcom detected suspicious activity on October 19. [2]

  3. SecurityWeek reported that passwords on 196 accounts were changed by the hackers. [3]

  4. BleepingComputer reported that Capcom confirmed the CAPCOM ID breach. [1]

Sources

  1. [1]BleepingComputer · Oct 22, 20:22 UTC
    Capcom confirms data breach affecting 11.7 million accountscontext
  2. [2]Help Net Security · Oct 23, 09:07 UTC
    Capcom data breach exposes 11.7 million account recordscontext
  3. [3]SecurityWeek · Oct 23, 08:34 UTC
    11 Million Impacted by Capcom Data Breachcontext
  4. [4]Security Affairs · Oct 24, 10:21 UTC
    Capcom Data Breach Exposes 11.7 Million Email Addressescontext