CAPCOM ID breach exposes 11,774,247 email and account-metadata records

L4: a confirmed mass disclosure. Metadata includes account creation, last login, login count and last-login IP. The 43 additional profiles include birth date, gender, country/region and nickname; both smaller groups are subsets, not extra victims.

Capcom reset the 196 changed passwords. It has not confirmed leakage of customers’ original passwords; credit-card data was excluded. Services remain available. The attack method was addressed but not publicly described, and affected customers will be contacted.

On October 23, Capcom confirmed that e-Capcom store account pages were accessed for 19 of those 196 accounts, all in Japan. Exposed fields include names and phonetic spellings, phone numbers, postcodes, addresses, gender, dates of birth, purchase histories, support inquiry histories and members’ address books. Capcom excluded credit-card data and found no additional disclosure in the other accounts due to the unauthorized password changes. The 19 accounts are a subset of the 196. Capcom says it finished its scope investigation, will continue monitoring related services and will contact affected customers individually.