Capcom ID breach exposes 11.7 million emails: what to do

Capcom has confirmed a large data breach affecting its CAPCOM ID service, the account system needed for online play in games such as Street Fighter 6. In a notice published on 22 October, the Osaka-based publisher said a third party gained unauthorised access to customer data, and the scale is big: 11,774,247 records worldwide.

What was exposed

According to Capcom, the leaked data falls into three groups:

• Email addresses and system data for all 11.77 million records. The "system-specific" data covers the date and time an account was created, the last login time, the number of logins and the IP address used for the last login.
• Date of birth, gender, country or region and nickname for 43 of those records.
• Unauthorised password changes on 196 accounts. Capcom says it found no sign that passwords set by customers themselves were leaked, and it has already reset the affected accounts.

In a second notice on 23 October (in Japanese), Capcom added that for 19 of the hijacked accounts, the attacker also opened the customer's page on its Japanese online shop, e-Capcom, exposing names, phone numbers, postal addresses, purchase history and enquiry history. Those 19 customers are all in Japan and are being contacted individually.

Credit card information was not included, Capcom says.

Timeline

Capcom detected suspicious activity on 19 October, blocked the access and confirmed the same day that a break-in had happened. It set up an incident response team on 20 October and reported the case to Osaka police and Japan's Personal Information Protection Commission on 21 October. The company says it has identified and fixed the attack method, and that its investigation into the scope is now complete.

What you should do

CAPCOM ID and all games that use it remain available, and you don't need to change your email address. The main risk now is phishing: with millions of addresses known to belong to Capcom players, scam emails that look like they come from Capcom or a game store are likely.

• Don't click links or open attachments in unexpected "Capcom" emails. Sign in by typing the address yourself.
• If you reused your CAPCOM ID password anywhere else, change it there too, and use a unique password from now on.
• Turn on two-step verification wherever your gaming accounts offer it.

Our guide to spotting fake apps on Google Play covers many of the same warning signs scammers use. If you play on PC with a pad, see our PC game controller buying guide.