KIungefiltert

· 4 min read · Auf Deutsch lesen

Capcom confirms CAPCOM ID breach: 11.7 million records exposed

Attackers accessed CAPCOM ID: 11,774,247 email addresses with login metadata and IP addresses were exposed, and 196 accounts had their passwords changed. Expect targeted phishing.

security

Translated from the German original with an AI language model, approved by me. Read the original

Capcom, the Japanese publisher behind Resident Evil, Monster Hunter and Street Fighter, has confirmed a breach of its account service CAPCOM ID. CAPCOM ID is the central user account for signing in to Capcom's web services and some of its online games. According to Capcom's official notice from October 22, 11,774,247 records worldwide are affected.

What happened

On October 19, Capcom detected suspicious activity, blocked the access and confirmed the same day that an unauthorized third party had gotten in. On October 20 the company set up an internal incident response team, and on October 21 it reported the incident to the Osaka Prefectural Police and Japan's data protection authority, the Personal Information Protection Commission. Capcom hasn't said how the attackers got in. It only says it has identified the attack method and put countermeasures in place. As of the latest reports, no group has claimed responsibility (Help Net Security).

What data was exposed

According to Capcom, BleepingComputer and SecurityWeek:

  • 11,774,247 records containing an email address plus account metadata: account creation date, last login, number of logins and the IP address used for the last login.
  • 43 records that also include date of birth, gender, country/region and nickname.
  • 196 accounts where the attackers changed the login password, locking the owners out. Capcom has since reset those passwords.
  • Not affected, according to Capcom: credit card data. Capcom also says it hasn't found that any passwords customers set themselves were compromised.

I need to correct my own post a little here. It said "change the password", which made it sound like passwords had leaked. Based on what we know now, they didn't. But the attackers were able to change passwords on 196 accounts, so they had at least some write access to account data. Capcom is still investigating how far that access went. A new password is still a sensible precaution, but it's not the most important step.

Why it matters

An email address on its own sounds harmless. Combine it with the knowledge that someone has a Capcom account, when they last logged in and from which IP address, and you have the raw material for convincing phishing. Phishing means fake messages that try to lure you onto a cloned login page or slip you malware. After news like this, an email saying "We reset your password following the incident, please confirm here" looks worryingly plausible. Capcom itself explicitly warns about emails and messages pretending to come from Capcom.

The IP address can also roughly reveal where someone was and which ISP they were using. For most of the people affected that's no big deal, but for targeted attacks it's one more piece of the puzzle.

A side note: this isn't the first time Capcom has been targeted. In 2020 the company was hit by the Ragnar Locker ransomware group. Capcom said the attackers got in through an old VPN device.

Who is affected

Anyone with a CAPCOM ID account, for example for Capcom's web services or online games. With 11.7 million records worldwide, if you have an account you should assume you're on the list. Capcom plans to notify affected customers in stages and has set up regional support channels: in the Americas through the Capcom USA support form, in Europe through Capcom Europe's contact form. Capcom says your registered email address can still be used.

What you should do now

  1. Distrust emails, texts and calls "from Capcom". Don't click links or open attachments. If you want to check something, go to Capcom's website yourself in your browser.
  2. Change your CAPCOM ID password as a precaution while the investigation continues.
  3. Replace that password anywhere else you reused it. A password manager makes this much easier long term.
  4. Check that you can still log in. If you can't, you may be one of the 196 accounts. Contact official support directly, not through a link in an email.
  5. Turn on two-factor authentication wherever it's offered, especially for accounts tied to the same email address.

In my view, step 1 matters most. The real risk from this breach is the emails that will show up over the coming weeks.

Sources