Capcom announced on October 22 that its unified membership service 'CAPCOM ID' suffered unauthorized access by a third party, resulting in the leak of 11.77 million user records, including email addresses. Among these, login passwords for 196 accounts were illicitly changed.
According to Capcom, as of October 22, 11,774,247 cases of email addresses and system-unique identifiers were leaked worldwide. Capcom disclosed this figure only as a 'worldwide total' and did not provide a breakdown by country or region. As a result, the extent of the impact on Korean users cannot be determined from the announcement alone.
System-unique identifiers refer to data recorded per account by Capcom's systems. This includes account creation dates and times, last login dates and times, login counts, and IP addresses used during the last login. For 43 of these cases, dates of birth, gender, country/region, and nicknames were also leaked alongside the other data. 'CAPCOM ID' is a unified account used across Capcom web services and select online games.
Capcom stated that it has already reset the passwords for the 196 accounts whose passwords were changed. The company added that no evidence of user-set passwords being leaked was found, and credit card information was not subject to the breach. The full scope of the unauthorized access continues to be investigated.
Services utilizing 'CAPCOM ID' remain accessible, and gameplay is unaffected. However, Capcom warned that phishing emails impersonating Capcom or related organizations could be sent using the compromised data. The company urged users who receive suspicious emails not to click on links (URLs) or open attached files. Registered email addresses can continue to be used.
Capcom explained that it completed emergency measures and identified and addressed the attack vector. Affected users will be contacted individually in sequence. In Japan, a dedicated toll-free phone hotline for this incident has been opened. Inquiries from users in Asia and Oceania outside of Japan will be handled through the existing Capcom Asia customer support email (info-asia@capcom.com).
Capcom discovered suspicious traces of unauthorized access on October 19 and blocked access. Following an investigation on the same day, it confirmed the intrusion. On October 20, the company established an internal response task force. Upon identifying data leaks and unauthorized password changes during its investigation, Capcom reported its findings to an external advisory body, the Security Supervisory Committee. On October 21, it reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission. The announcement did not state when the intrusion originally began.
Capcom stated that it will determine the cause, establish measures to prevent recurrence, and communicate any newly confirmed facts through its official website and other channels.
