- Capcom says a third party exposed email addresses and login records for 11,774,247 Capcom ID accounts and changed passwords on 196 of them.
- Capcom says card data was not included, but warns the list could fuel phishing. The password changes suggest the intruder could do more than read data, in WebPulse's view.
- Leaders should list which services share one customer login, test whether they can spot account changes customers did not make, and prepare support for phishing worries.
What Capcom says happened
Capcom, the Japanese game publisher, says a third party gained unauthorised access to Capcom ID. This is the shared account people need to use Capcom's web services and some of its online games.
Capcom reports that email addresses and system identifiers were exposed for 11,774,247 accounts worldwide. The identifiers are the account creation time, the last login time, the number of logins and the client IP address used at the last login.
For 43 of those accounts, more was exposed: date of birth, gender, country or region, and nickname. Capcom says credit card data was not included. It also says play was not affected in any game.
Write access, not just a copy
The detail that deserves most attention is smaller. Capcom found that passwords had been changed without authorisation on 196 accounts.
Capcom says it has not confirmed any leak of the passwords customers set themselves. It has reset the 196 accounts. It says its investigation into the effects of the intrusion continues.
Reading a list and altering an account are different acts. The second means the intruder could do more than look. This is WebPulse's reading of Capcom's account, not a finding Capcom has stated.
Capcom has not published how the intruder got in. It says it has identified the method of attack and completed its response. Outsiders cannot yet judge how the password changes were made or whether other fields could be changed.
What a list of addresses is worth
Capcom warns that the leaked data could be used to send suspicious emails posing as Capcom or related companies. Notebookcheck, which reported the story, makes the same point about phishing.
Consider what the list contains. Each address belongs to someone with a Capcom account. A message that mentions Capcom matches something real in the recipient's life.
Login counts and last-login dates may also show which accounts are active. That is an inference, not something Capcom has said. In WebPulse's judgment, most customers would not expect their last-login IP address to leave the company.
The lesson here is that "no passwords, no cards" describes what was not taken. It does not describe what the stolen data can be used for.
One account, many doors
Capcom describes Capcom ID as a common account across its web services and some games. That design makes sign-in simple for customers. It also means one weak point sits behind many services.
Capcom has not reported any effect on other services. It says play was not affected in any game, and its investigation continues. So this point is about how the design is exposed, not about spread that has been shown.
The size of an identity breach is set by how much hangs off the identity. Eleven million records is a count of accounts, not of products.
October 19 to October 21: from detection to regulators
Capcom says it found signs of unauthorised access on October 19. It blocked the access and confirmed the intrusion the same day. On October 20 it set up an internal task force. It found the leaked data and the password changes, and reported to its external Security Supervisory Committee.
On October 21, Capcom reported to the police and to Japan's Personal Information Protection Commission. It has opened support lines for Japan, the Americas, Europe, the Middle East and Africa, and Asia and Oceania. It is contacting affected customers one by one.
Questions for your team
Start with scope. Which products, partners and apps sign in through one shared customer account in your company? Ask for the list, not an estimate.
Ask about detection. Capcom found 196 passwords changed without the owners' consent. Could your team spot account changes that the customer did not make?
Ask what sits on each account beyond credentials. Login history and IP addresses are useful for security. They are also data that can be exposed.
Ask who gets called in the first days after detection, and whether regional customer support is ready to answer phishing worries in every market you serve.
A breach without passwords or card numbers still hands attackers a customer list. Plan for what they can do with it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Capcom.
