Hero image: Street Fighter 6. Image: Capcom
Capcom has told customers that a third party accessed information held against 11,774,247 Capcom ID records worldwide.
The publisher set this out in a press release dated 22 October and added to it in an update on 23 October. It describes Capcom ID as a unified account needed to play certain Capcom games online.
The records contain email addresses and system-specific identifiers. Capcom lists those as the date and time of account creation, the date and time of last login, the number of logins and the client IP address used during last login.
Of the total, 43 records also held a date of birth, gender, country or region, and nickname. Capcom says credit card information was not included.
The notice is plain about passwords.
“Capcom has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves. However, the company has confirmed that passwords were changed without authorization on 196 accounts.”
The timeline in the notice runs over three days. On 19 October Capcom detected suspicious activity and confirmed unauthorised access the same day.
On 20 October it set up an internal incident response headquarters and reported the matter to its external advisory body, the Information Technology Security Oversight Committee.
On 21 October it reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
The update narrows the damage from the password changes. Capcom says an unauthorised third party had accessed the e-Capcom account pages of 19 of the 196 accounts.
e-Capcom is an online store operated by Capcom in Japan, and the 19 records are all in Japan. The information affected there includes name, telephone number, address, date of birth, purchase history and saved address book information.
Capcom says the investigation into the scope of impact from the password changes has been completed.
Capcom says services that use Capcom ID, including games, remain available. For customers, its advisory is the part to act on.
“However, there is a possibility that the affected information could be misused to send fraudulent emails or other communications impersonating Capcom or related parties. If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files.”
The notice lists dedicated support channels by region. For Asia excluding Japan, and Oceania, it gives one contact, an email address: info-asia@capcom.com. It does not give a separate Australian channel.
Source: Capcom – Notice and Apology Regarding Customer Information Affected Through Unauthorized Access, Capcom – Update to Notice and Apology