Capcom confirmed unauthorized access to 11,774,247 CAPCOM ID accounts. I'm a few days late on it, and it's a gaming company, not a bank. But anything at this scale ends up in phishing campaigns aimed at your employees, so it's worth a minute.
What Was Exposed
Per Capcom's disclosure:
- For all 11.7 million accounts: email addresses plus account data like creation date, last login time, number of logins, and the IP address of the most recent sign-in.
- For 43 accounts: date of birth, gender, country or region, and nickname.
- 196 accounts had their passwords changed by the attackers. Capcom has reset them.
- Not exposed, per Capcom: no evidence customer passwords were compromised, and payment card info wasn't affected.
Capcom detected it on October 19, confirmed it the same day, and reported it to police and Japan's privacy regulator by October 21. Credit for moving fast and being specific. They haven't said how the attackers got in, and nobody has claimed it.
Why "No Passwords" Isn't the End of It
Two things jump out.
196 password changes means takeover, not just a data grab. Attackers didn't only read data. They took over accounts. Small number, but it tells you what they could do.
Email plus last login plus IP is a phishing kit. "We noticed a login from [your real IP] on [your real date], verify your account" is a very convincing email when the details are true. And plenty of people use the same email and password at work that they use for gaming.
What To Do
- If you have a CAPCOM ID, change the password, and change it anywhere else you reused it. Turn on MFA where it's offered.
- Ignore emails "from Capcom" with links. Capcom itself says not to click URLs or open attachments in suspicious messages.
- Security teams: expect a bump in credential stuffing and breach-themed phishing. Phishing-resistant MFA and blocking known-breached passwords do more here than any awareness email.
Bottom Line
A breach without passwords is still a breach. The data that leaked is exactly what makes the next phishing email believable. Assume the follow-up attack is coming, because it usually is.
Sources: Help Net Security and BleepingComputer