Capcom said a third party gained unauthorized access to CAPCOM ID, the shared registered account customers need to use the company's web services and some of its online games, and that part of the customer information held there leaked. The Tokyo Prime-listed game maker put the widest category at 11,774,247 accounts worldwide as of October 22.
What leaked
The broadest category covers email addresses and system-specific identifiers: account creation date and time, last login date and time, number of logins and the client IP address at last login. That is the 11,774,247 figure, counted in accounts, and Capcom's notice does not say how many individual people that represents.
A far smaller group lost more. Of those accounts, 43 also had date of birth, gender, country or region, and nickname exposed.
Capcom said credit card information was not among the leaked data.
The password changes
Separately, Capcom found that login passwords had been changed without authorization on 196 of the affected accounts. Those accounts have already had their passwords reset. The 196 accounts are a different category from the 43 with additional personal fields, and the notice does not say whether they overlap.
Capcom said it has not confirmed a leak of passwords customers set themselves. That is a statement about what has been confirmed so far, and the company said it is still investigating the extent of the impact.
Timeline and response
Capcom said it found traces of suspected unauthorized access on October 19, blocked the access, began investigating and confirmed the intrusion the same day. On October 20 it set up an internal task force, found that some customer information had leaked and that some passwords had been changed, and reported the matter to its external advisory body, the Security Supervisory Committee. On October 21 it reported to the police and to the Personal Information Protection Commission.
The company said it has completed emergency measures and identified and dealt with the attack method. Services that use CAPCOM ID remain available and play of all games is unaffected. Affected customers are being contacted individually, and Capcom has opened a dedicated inquiry line in Japan and regional support channels for the Americas, Europe, the Middle East and Africa, and Asia excluding Japan and Oceania.
What customers should watch
Registered email addresses can still be used, but Capcom warned that leaked information could be abused to send suspicious emails posing as Capcom or related parties. It asked customers not to open links or attachments in such messages. The company also said it will take measures to prevent a recurrence and publish any new facts on its official website.