Capcom, the Japanese publisher behind Resident Evil, Monster Hunter and Street Fighter, has disclosed that an intruder got into the customer database behind its CAPCOM ID membership service. The company puts the number of affected records at 11,774,247 worldwide.
What happened
According to a notice Capcom posted on October 22, staff spotted suspicious activity on CAPCOM ID on Monday, October 19, began blocking the access and confirmed the same day that a third party had broken in. An internal incident response headquarters was set up on October 20, and by then the company had established that customer records had been reached. On October 21 Capcom notified the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
Capcom says it has identified and closed off the attack method, but it has not said how the attacker got in or when the intrusion first began.
Who is affected and what was exposed
CAPCOM ID is the single sign-in that Capcom uses for its web services and for online play in several of its games, so many players will have an account even if they rarely think about it. The exposed data breaks down into three tiers:
- 11,774,247 records: the email address tied to the account plus system metadata, namely when the account was created, the time of the last login, the total number of logins and the IP address used at the last login.
- 43 records: in addition to the above, date of birth, gender, country or region and nickname.
- 196 accounts: the attacker changed the CAPCOM ID login password without permission. Capcom has reset those passwords.
Capcom says it has found no sign that the passwords customers set themselves were stolen, and that payment card data was not part of the exposed information. Games and CAPCOM ID-linked services remain online, and players do not need to change the email address on their account.
Why it matters
Email addresses paired with login history and IP addresses are valuable raw material for phishing. An attacker who knows that a person plays Capcom games, when they last signed in and roughly where from can craft a very convincing fake "security alert" or "account verification" message. The 196 hijacked passwords also show the attacker was able to do more than just read data, which is why Capcom is still investigating the full scope.
This is not Capcom's first major incident. In November 2020 the Ragnar Locker ransomware gang hit the company, claimed to have stolen about 1 TB of data, and Capcom later said information on up to 390,000 people could have been involved.
What you should do
- Expect phishing. Treat any email, text or direct message claiming to come from Capcom with suspicion. Don't click links or open attachments in unexpected messages; go to Capcom's site directly instead.
- Check your account. Sign in to CAPCOM ID by typing the address yourself and confirm your password and email still work. If you were locked out, contact Capcom support.
- Change reused passwords. If your CAPCOM ID password is used anywhere else, change it on those services and switch to unique passwords stored in a password manager.
- Turn on extra protection such as two-factor authentication wherever you can, especially on your email account and gaming platforms.
- Watch for Capcom's notice. The company says it will contact affected customers and has opened regional support channels for questions.
Sources
0 Comments