Capcom says an unauthorised third party accessed Capcom ID customer information on October 19, and its investigation into the impact is complete.
According to Capcom, 11,774,247 email addresses were leaked together with account related details. Notebookcheck lists those details as account creation dates, last login dates, the number of logins and the IP address from the most recent login. A much smaller group of 43 accounts had more exposed, including dates of birth, gender, country or region, and nicknames. Nintendo Life, citing the notice on Capcom's website, describes the same split between the broad email exposure and the narrower set of extra personal details.
Passwords reset and e-Capcom accounts
Capcom confirmed that passwords were changed without authorisation on 196 accounts, and the company has reset them. A later update from the publisher says the third party also reached the e-Capcom account pages of 19 of those 196 accounts. E-Capcom is the online store Capcom operates in Japan. For those 19 accounts, the exposed data included name, phonetic name, telephone number, postal code, address, gender, date of birth, purchase history, customer inquiry history and saved address book information.
What it means for players
Players can keep using their games, since Capcom says services that rely on Capcom ID, including games, remain available. The publisher also says it has found no evidence that passwords customers originally set were leaked, and credit card information was not part of the compromised data. The bigger risk is phishing. Notebookcheck notes that with so many email addresses exposed, attackers could try messages posing as Capcom. Nintendo Life suggests Capcom ID holders consider updating their password and other details.
What Capcom does next
Capcom says its emergency response is complete and that it has pinpointed and dealt with the attack method. In its update on October 23, the publisher stated that the investigation into the scope of the impact is finished, although it will keep monitoring Capcom ID and related services. Capcom is contacting affected customers and has set up dedicated support channels for questions. GamesIndustry.biz also recalls that Capcom was hit by a ransomware attack in November 2020 that compromised the data of 16,415 people.
Our Take
We think the gap between the wide email exposure and the narrow set of accounts with extra data is the key detail here. Millions of email addresses in an attacker's hands matter more for phishing than the small group of accounts with personal details. Capcom says customer set passwords were not leaked and card data was untouched, but we would still treat any Capcom email with suspicion and expect more questions about the e-Capcom store accounts.
GamingBroject
Source: Notebookcheck
Source: GamesIndustry.biz
Source: Nintendo Life
Follow GamingBroject on Google: add us as a preferred source
Community
0 comments