Capcom has been hit by a data breach that affected over 11.7 million Capcom ID accounts.
Capcom ID is used to manage online features, web services, and multiplayer across its portfolio, including for titles such as Street Fighter 6, Monster Hunter, and Resident Evil.
The publisher determined that on October 19, customer information was accessed by an unauthorised third party.
“Capcom has not confirmed any compromise of Capcom ID account login passwords originally set by customers themselves,” the publisher said in a statement posted yesterday.
“However, Capcom has confirmed that passwords were changed without authorisation on 196 accounts. The passwords associated with these accounts have already been reset, and the company continues to investigate the scope of any impact resulting from this incident.”
“Capcom has completed emergency response measures and has identified and addressed the attack method involved in this incident. Services that use Capcom ID, including games, remain available. Going forward, the company will begin contacting affected customers and has established dedicated customer-support channels for inquiries regarding this matter.”
In an update posted today (October 23), Capcom said it had “confirmed that login passwords had been changed without authorisation for 196 accounts due to this incident. During the subsequent investigation, the company has determined the scope of impact stemming from the unauthorised change of passwords.”
The publisher determined that this third party accessed the e-Capcom (online store operated by Capcom in Japan) account pages of 19 of the 196 accounts whose passwords had been changed.
Affected information included: name, name in Japanese phonetic characters, telephone number, postal code, address, gender, date of birth, purchase history, e-Capcom customer inquiry history, and saved address book information.
Credit card information was not affected.
“The investigation into the scope of the impact from this incident has been completed. Capcom will nevertheless continue monitoring Capcom ID and related services. The Company takes this incident extremely seriously and will steadily implement measures to prevent recurrence while working to further strengthen its information-security framework.”
Capcom was previously hit by a ransomware attack in November 2020 that compromised the data of 16,415 people.
The publisher said the maximum number of people potentially affected by the hack could be 390,000.