Resident Evil makers Capcom reveal data breach has affected over 11 million Capcom ID accounts, warn against potential phishing emails
"Credit card information was not included among the affected information," say the publishers
Resident Evil, Street Fighter, and Monster Hunter publishers Capcom have revealed that a data breach has seen a third-party gain access to information associated with more than 11 million Capcom ID accounts. "Suspicious activity" around the service, required to play online in the likes of Street Fighter 6, was initially noticed on October 19th according to Capcom, who have spent the past couple of days taking measures to contain and combat the problem.
Capcom have outlined in a press release that a total of 11,774,247 accounts had their email addresses and "system-specific identifier information" accessed in the breach. 43 of those accounts also had their date of birth, gender, country/region, and nickname records accessed.
"Capcom has not confirmed any compromise of Capcom ID account login passwords originally set by customers themselves," the company wrote. "However, the company has confirmed that passwords were changed without authorisation on 196 accounts. The passwords associated with these accounts have already been reset, and the company continues to investigate the scope of any impact resulting from this incident. Going forward, Capcom will notify customers affected by this incident. Credit card information was not included among the affected information.
As for other advice to affected folks, Capcom issued the following warning regarding the possibility of phishing attacks directed at the email addresses exposed in the breach:
"Email addresses registered with Capcom ID may continue to be used without interruption. However, there is a possibility that the affected information could be misused to send fraudulent emails or other communications impersonating Capcom or related parties. If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files."
Having reported the breach to Osaka's Prefectural Police and Japan’s Personal Information Protection Commission as part of their initial response, which they say "identified and addressed the attack method involved in this incident", Capcom will now plough on with a "detailed investigation" designed to flag measures that might stop this sort of thing happening again in the future.