Capcom says 11.77 million CAPCOM ID records leaked in unauthorized access
In short
Capcom said on 22 October that a third party gained unauthorized access to its CAPCOM ID account service, leaking 11,774,247 records worldwide that include email addresses. Login passwords were illegally changed on 196 accounts and have been reset. The company said credit card information was not leaked and that games are not affected.
Read the full story 2 min read
Capcom said on 22 October that a third party gained unauthorized access to CAPCOM ID, its common account service, and that 11,774,247 records worldwide were leaked. Game*Spark described CAPCOM ID as the account used for online games such as Street Fighter 6 and Capcom's web services. The leaked data include email addresses and system-specific identifiers. [ 2 , 3 , 5 , 6 , 7 , 9 ]
According to the company's announcement as reported by INSIDE and Game*Spark, the identifiers cover the account creation date and time, the last login time, the number of logins and the client IP address at last login. In 43 of the cases, birth date, gender, country or region and nickname also leaked. Login passwords were illegally changed on 196 accounts, which Capcom has since reset. Capcom said no leak of passwords set by users has been confirmed and that credit card information was not included. [ 2 , 3 , 6 ]
Capcom said it found traces of suspected unauthorized access on 19 October, blocked the access and confirmed the intrusion the same day. On 20 October it set up an internal task force, and the investigation showed that customer information had leaked and that some passwords had been changed. It also reported the matter that day to its Security Supervisory Committee, an external advisory body. On 21 October it reported to the police and the Personal Information Protection Commission. [ 2 , 3 , 6 ]
The company said it has completed emergency measures and identified and addressed the attack method. It said services using CAPCOM ID remain available and that play of all games is not affected. Capcom is contacting affected users in turn and has opened a dedicated inquiry line, 0120-801-271, which Nippon TV and Asahi Shimbun said is open from 10:00 to 20:00. [ 2 , 3 , 7 , 9 ]
Capcom warned that the leaked information could be misused to send suspicious emails posing as Capcom or related parties, and asked recipients not to open URLs or attachments in such messages. Yomiuri Shimbun reported that no cases such as unintended paid-service sign-ups had been confirmed so far, and that Capcom said it cannot disclose how the passwords came to be changed. Whether the changed passwords were used for logins the users did not intend was described as under investigation, according to Yomiuri. Asahi Shimbun reported Capcom said the case is unrelated to the PHP programming language. [ 3 , 9 , 13 , 15 ]
In its statement, quoted by INSIDE, Capcom said it takes the matter seriously and will continue a detailed investigation, take measures to prevent recurrence and strengthen its information security. It said it will announce any newly found facts on its official website. [ 3 ]
Why it matters
The leaked email addresses could be used to send suspicious emails posing as Capcom or related parties, and Capcom has warned users about this. The company said its investigation into the scope continues.
Key facts
- Capcom announced on 22 October that unauthorized access to CAPCOM ID leaked 11,774,247 records worldwide. [ 2 , 3 , 5 , 6 , 7 , 9 ]
- The leaked data include email addresses and system-specific identifiers: account creation date and time, last login time, number of logins and the client IP address at last login. [ 2 , 3 ]
- In 43 of the cases, birth date, gender, country or region and nickname also leaked. [ 2 , 3 , 6 , 7 , 13 ]
- Login passwords were illegally changed on 196 accounts, and Capcom has reset the passwords. [ 2 , 3 , 5 , 6 , 7 , 9 , 13 ]
- Capcom said credit card information was not included in the leak and that no leak of passwords set by users has been confirmed. [ 2 , 3 , 5 , 6 , 7 , 9 , 13 ]
- Capcom found traces of suspected unauthorized access on 19 October and confirmed the access the same day. [ 2 , 3 , 5 , 7 ]
- Capcom said CAPCOM ID services remain available and that play of all games is not affected. [ 2 , 3 , 5 , 6 ]
Confirmed by several sources
- Capcom announced that 11,774,247 records (worldwide total) were leaked from CAPCOM ID through unauthorized access. [ 2 , 3 , 5 , 6 , 7 , 9 ]
- Login passwords were illegally changed on 196 accounts, which have been reset. [ 2 , 3 , 5 , 6 , 7 , 9 , 13 ]
- Credit card information was not part of the leak. [ 2 , 3 , 5 , 6 , 7 , 9 ]
- Capcom found the traces on 19 October, and reported to the police and the Personal Information Protection Commission on 21 October. [ 2 , 3 , 6 ]
- Capcom set up a dedicated inquiry line and is contacting affected users in turn. [ 2 , 3 , 5 , 6 , 7 ]
Still unclear
- How the passwords were illegally changed. Yomiuri reported that Capcom said it cannot disclose how the passwords came to be changed.
- Whether the changed passwords were used for logins the account holders did not intend. Yomiuri reported Capcom described this as under investigation.
- The full extent of the impact. Capcom said it is continuing to investigate the scope of the effect of the unauthorized access.
- Whether the 196 accounts have been reset or are being asked to reset. Most outlets say the passwords have already been reset, while TBS NEWS DIG said Capcom is calling for passwords to be set again.
What local media are saying
Timeline, local time
- Capcom finds traces of suspected unauthorized access to CAPCOM ID, blocks the access and confirms the intrusion the same day. [ 2 , 3 , 5 ]
- Capcom sets up an internal task force, finds that customer information leaked and some passwords were changed, and reports to its external advisory body. [ 2 , 3 , 6 ]
- Capcom reports to the police and the Personal Information Protection Commission. [ 2 , 3 , 6 ]
- Game*Spark and INSIDE publish reports on Capcom's announcement. [ 2 , 3 ]
- Nikkei reports the leak of about 11.77 million records. [ 6 ]
- Yomiuri reports that Capcom cannot disclose how the passwords were changed. [ 15 ]