Capcom discloses CAPCOM ID breach exposing 11.77 million email addresses; attackers changed passwords on 196 accounts
Capcom disclosed a data breach affecting CAPCOM ID, its shared account service for online services and games, discovered on October 19. The attackers stole 11,774,247 email addresses along with account metadata: creation date, last login date, login count and the IP address of the last login. For 43 customers, dates of birth, gender, country/region and nicknames were also compromised. The attackers changed CAPCOM ID passwords on 196 accounts, although Capcom states that no user passwords were compromised. The company has reset the affected passwords, notified the relevant authorities and is still investigating. The article does not attribute the intrusion to any actor or describe the initial access vector.
Detalhes técnicos
- Compromised asset: CAPCOM ID authentication and account service.
- Data exposed: email addresses and account metadata (account creation date, last login date, number of logins, last login IP). A smaller subset also lost personal data (date of birth, gender, country/region, nickname).
- Integrity impact: unauthorized password changes on 196 accounts.
- Capcom says all services using CAPCOM ID remain available.
Remediação
- Capcom reset the passwords of the affected accounts, is contacting affected customers and has set up a dedicated contact point.
- Users should be wary of unsolicited emails impersonating Capcom or related entities that contain suspicious URLs or attachments.
Linha do tempo
-
Capcom discloses CAPCOM ID breach exposing 11.77 million email addresses; attackers changed passwords on 196 accounts
ler a análise desta fonte ocultar
Capcom disclosed a data breach affecting CAPCOM ID, its shared account service for online services and games, discovered on October 19. The attackers stole 11,774,247 email addresses along with account metadata: creation date, last login date, login count and the IP address of the last login. For 43 customers, dates of birth, gender, country/region and nicknames were also compromised. The attackers changed CAPCOM ID passwords on 196 accounts, although Capcom states that no user passwords were compromised. The company has reset the affected passwords, notified the relevant authorities and is still investigating. The article does not attribute the intrusion to any actor or describe the initial access vector.
Technical Details
- Compromised asset: CAPCOM ID authentication and account service.
- Data exposed: email addresses and account metadata (account creation date, last login date, number of logins, last login IP). A smaller subset also lost personal data (date of birth, gender, country/region, nickname).
- Integrity impact: unauthorized password changes on 196 accounts.
- Capcom says all services using CAPCOM ID remain available.
Remediation
- Capcom reset the passwords of the affected accounts, is contacting affected customers and has set up a dedicated contact point.
- Users should be wary of unsolicited emails impersonating Capcom or related entities that contain suspicious URLs or attachments.