[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foCIFYZV_V4MKYkcFfiCQay_iE8JGtXm_hRfGpgO5-Rg":3},{"article":4,"iocs":38,"watch_terms":43,"solutions":44,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"2c55da54-40c4-4140-a3c4-a44145ff97db","11 Million Impacted by Capcom Data Breach","11-million-impacted-by-capcom-data-breach-a84146","The hackers stole 11 million email addresses from CAPCOM ID and changed the login passwords for 196 accounts. The post 11 Million Impacted by Capcom Data Breach appeared first on SecurityWeek.","Capcom has disclosed a data breach affecting over 11 million CAPCOM ID users. Hackers gained unauthorized access and stole email addresses, account creation dates, login history, and IP addresses. For a smaller subset of users, dates of birth, gender, country, and nicknames were also compromised. While no passwords were stolen, 196 accounts had their passwords reset by the attackers.","Capcom data breach impacts 11 million CAPCOM ID users with stolen email addresses.","https:\u002F\u002Fwww.securityweek.com\u002F11-million-impacted-by-capcom-data-breach\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FCapcom.jpeg","2026-10-23T08:34:14+00:00","2026-10-23T10:00:05.074179+00:00",7,[17],{"name":18,"type":19},"Capcom","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":20,"icon":22,"name":23,"slug":24},null,"Breaches","breaches",[26,28,33],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39],{"type":40,"value":41,"context":42},"ip","196","Number of accounts with changed passwords",[18],{"controls":45,"vendors":133},[46,75,104],{"slug":47,"name":48,"problem":49,"products":50},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":76,"name":77,"problem":78,"products":79},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"slug":105,"name":106,"problem":107,"products":108},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":146},"capcom-data-breach-exposes-11-million-users-personal-data","Capcom Data Breach Exposes 11 Million Users' Personal Data","Attackers gained unauthorized access to Capcom's systems and exfiltrated personal data belonging to over 11 million users, including email addresses, IP addresses, and login histories. The breach is particularly concerning because attackers were able to actively reset passwords for 196 accounts, indicating a significant level of system access beyond simple data exfiltration. This incident highlights the critical importance of robust access controls, data minimization practices, and timely detection of unauthorized activity. When large volumes of personal data are aggregated without sufficient protection, a single breach can have widespread consequences for millions of individuals.",[139,140,141,142,143,144,145],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","GDPR Article 32","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(b)",{"GDPR Article 32":147,"NIS2 Article 21(2)(b)":148,"NIST SP 800-53 SI-2: Flaw Remediation":149,"CIS Control 17: Incident Response Management":150,"CIS Control 14: Security Awareness and Skills Training":151,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":152,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":153},"GDPR Article 32 requires organizations to implement appropriate technical measures to protect personal data; encrypting the 11 million users' PII at rest would have significantly reduced the impact of this breach.","NIS2 mandates incident handling and access control measures for entities holding large volumes of user data; compliance would have required Capcom to have controls in place that could have prevented or detected this breach earlier.","Systematic identification and remediation of security flaws in systems handling user account data would have reduced the attack surface available to the threat actors.","A mature incident response plan would have enabled Capcom to detect the unauthorized access and account password resets faster, reducing the number of affected users and limiting data exfiltration.","Training staff to recognize and report indicators of unauthorized access or suspicious administrative activity could have enabled earlier detection of the breach.","Regular vulnerability assessments of the systems storing user data would have identified security weaknesses before attackers could exploit them to gain unauthorized access.","Stronger identity verification and access controls, including MFA and least-privilege enforcement, would have limited the attackers' ability to gain unauthorized access and reset user passwords."]