Late in October, a major Japanese game studio discovered that someone had slipped past its defences and reached the personal records of its players. Capcom has since counted the cost in millions of email addresses, along with the quieter details that come with every online account, such as when it was made and where its owners logged in from. The company has contained the intrusion, informed the authorities, and begun writing to the people affected, a reminder that in the digital age a gamer's trust is held in ledgers they never see. What remains unsettled is how far the damage reaches, and fo
Capcom Confirms Breach Exposing Emails of Nearly 11.8 Million Customers, Including Australian Gamers
Millions of customers face potential phishing and fraud risk from exposed personal data, including Australian gamers.
The company says it is still investigating how far the impact reaches.
Mark
Eleven point seven million emails is a huge number. What exactly was taken?
Mimi
Mostly emails, plus account metadata: when the account was created, last login, how many logins, and client IP addresses. For 43 records there was more, including date of birth, gender, country and nickname.
Mark
And the passwords?
Mimi
Capcom says it hasn't confirmed any compromise of passwords customers originally set. But 196 accounts had passwords changed without authorisation, and those have been reset.
Luke
That deserves care. The no-compromise claim is Capcom's own statement, and the wording is that it hasn't confirmed compromise, which is not the same as saying it has ruled it out.
Mark
So what's the real risk to a customer?
Mimi
Phishing. Capcom itself says the data could be used to send emails impersonating the company, and it tells people not to click links or open attachments in suspicious messages.
Luke
Worth noting we don't know who the third party is or what they intend. Nothing in the reporting says the data has been published or sold.
Mark
How fast did Capcom move?
Mimi
Detection on October 19, a response headquarters and confirmation of access on October 20, and police and the privacy regulator notified on October 21.
Luke
And the scope is still under investigation, so the 11.77 million figure and the 196 accounts are what Capcom has confirmed so far, not necessarily the final tally.
Mark
Any Australian angle?
Mimi
Australian customers started receiving breach notifications on Friday morning, according to Cyber Daily's understanding.
Il Polso
- Capcom spotted suspicious activity on October 19 and blocked unauthorised access before it could fully unfold.
- Records for 11,774,247 email addresses were reached, along with account creation dates, login histories and client IP addresses.
- 196 accounts had their passwords changed by intruders, and those accounts have been forced into resets while the scope is still being traced.
- Police in Osaka and Japan's Personal Information Protection Commission were alerted on October 21, and Australian players have begun receiving breach notices.
- Customers are being urged to distrust unexpected emails, avoid links and attachments, and watch for phishing that borrows Capcom's name.
Late in October, a major Japanese game studio discovered that someone had slipped past its defences and reached the personal records of its players. Capcom has since counted the cost in millions of email addresses, along with the quieter details that come with every online account, such as when it was made and where its owners logged in from. The company has contained the intrusion, informed the authorities, and begun writing to the people affected, a reminder that in the digital age a gamer's trust is held in ledgers they never see. What remains unsettled is how far the damage reaches, and for millions of people the immediate lesson is simply to doubt any message that claims to speak for Capcom.
On October 19, Capcom's systems flagged activity that did not belong there. The company moved quickly, blocking the unauthorised access and standing up an incident response team by the next day. Within days it confirmed that an unknown party had reached customer information, a tally now standing at 11,774,247 email addresses.
The exposure reaches past inboxes. Account creation dates, last logins, login counts and client IP addresses were also visible. A smaller group of 43 records held more sensitive details, including birth dates, gender, country or region and nicknames.
Separately, 196 accounts had their passwords changed without permission, and Capcom has reset them. The company stresses that the passwords customers originally chose for their CAPCOM IDs have not been confirmed as compromised, and it is still working out how far the impact extends.
Capcom has informed the Osaka Prefectural Police and Japan's Personal Information Protection Commission, and it says its emergency measures are complete. Notices are now going out to affected players, Australians among them. The company has apologised for the worry this has caused, but the practical reality for millions of players is caution: treat any message claiming to be from Capcom with suspicion until the picture is clearer.
On October 19, Capcom's systems showed what the company calls suspicious activity. The Japanese game developer blocked the unauthorised access and began investigating. Within days it had confirmed that customer information had been reached by an unknown third party, and the number it has now attached to the breach is 11,774,247 email addresses.
The exposed data goes beyond the emails themselves. Capcom says it also covers system-specific account details: the date and time each account was created, the last login, the number of logins, and the client IP addresses. For a much smaller group of 43 records, the exposure was wider still, taking in date of birth, gender, country or region, and nickname.
The company also identified 196 accounts whose passwords were changed without authorisation. Capcom says those passwords have been reset. It drew a distinction on the broader question of credentials: it has not confirmed any compromise of CAPCOM ID login passwords that customers originally set for themselves. The changed passwords on those 196 accounts are a separate matter, and the company says it is still investigating how far the impact reaches.
The timeline Capcom has laid out is short. After detecting the activity on October 19, it set up an incident response headquarters by October 20 and confirmed that customer information had been accessed. On October 21 it notified the Osaka Prefectural Police and Japan's Personal Information Protection Commission. The company says it has completed its emergency response measures and is now notifying the customers affected.
Australian players are among them. Cyber Daily understands that Australian customers began receiving breach notifications on Friday morning.
Capcom says the email addresses tied to a CAPCOM ID can continue to be used, but it warns that the exposed information could be misused to send fraudulent emails or other messages impersonating Capcom or related parties. Its guidance to customers is to be cautious with any suspicious email or message, to avoid opening any URLs in it, and not to open attached files.
The company's statement apologises twice, once at the start and once at the close, to customers and other stakeholders for the complications and concern caused. What remains open is the scope of the damage from the 196 unauthorised password changes, which Capcom says it is still investigating. For the millions of people on the list, the practical step for now is to treat anything claiming to come from Capcom with suspicion.
Citazioni salienti
There is a possibility that the affected information could be misused to send fraudulent emails or other communications impersonating Capcom or related parties.— Capcom
Capcom has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves.— Capcom
Vuoi la storia completa?
Leggi l'originale su Cyber Daily ↗
Business