[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhlHZ_biN_LYWEhqh8XVvdF8wzAdGEYT2l3VWznHH_fM":3},{"article":4,"iocs":38,"watch_terms":43,"solutions":44,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"f77fc3fa-9f1e-4c30-afd1-48ce101273f7","Capcom Data Breach Exposes 11.7 Million Email Addresses","capcom-data-breach-exposes-11-7-million-email-addresses-39668b","Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and games. As of October 22, attackers stole 11,774,247 email addresses, […]","Capcom has disclosed a data breach affecting its CAPCOM ID service, resulting in the exposure of 11,774,247 email addresses and associated account details. The stolen information includes creation dates, last login dates, login counts, and IP addresses. In a subset of cases, sensitive data like date of birth and gender was also compromised, and passwords were changed for some accounts.","Capcom ID service breached, exposing over 11.7 million email addresses and account details.","https:\u002F\u002Fsecurityaffairs.com\u002F201626\u002Fdata-breach\u002Fcapcom-data-breach-exposes-11-7-million-email-addresses.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2020\u002F11\u002Fcapcom.jpg","2026-10-24T10:21:53+00:00","2026-10-24T12:00:17.961378+00:00",7,[17],{"name":18,"type":19},"Capcom","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":20,"icon":22,"name":23,"slug":24},null,"Breaches","breaches",[26,28,33],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39],{"type":40,"value":41,"context":42},"malware","Ragnar Locker","Mentioned as a previous threat actor targeting Capcom.",[18],{"controls":45,"vendors":130},[46,75,104],{"slug":47,"name":48,"problem":49,"products":50},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":76,"name":77,"problem":78,"products":79},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":105,"name":106,"problem":107,"products":108},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":126,"product_name":127,"url":128,"description":129},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":143},"capcom-id-breach-exposes-117-million-user-records","Capcom ID Breach Exposes 11.7 Million User Records","Capcom's CAPCOM ID service suffered a significant data breach that exposed nearly 12 million email addresses along with associated account metadata such as login timestamps and IP addresses, with a subset of users also losing sensitive personal data like dates of birth and gender. This incident highlights the critical importance of minimising the personal data stored in user account systems — a principle known as data minimisation — so that when breaches occur, the blast radius is limited. The exposure of IP addresses and login behaviour data further compounds the risk, enabling secondary attacks such as credential stuffing or targeted phishing. Gaming platforms and consumer-facing services are high-value targets precisely because they aggregate large volumes of personal data, making robust access controls, encryption at rest, and strict data retention policies essential safeguards.",[136,137,138,139,140,141,142],"GDPR Article 32","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 3: Data Protection","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(b)",{"GDPR Article 32":144,"NIS2 Article 21(2)(b)":145,"CIS Control 3: Data Protection":146,"NIST SP 800-53 SI-2: Flaw Remediation":147,"CIS Control 17: Incident Response Management":148,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":149,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":150},"Article 32 requires organisations to implement appropriate technical and organisational measures to protect personal data; the exposure of 11.7 million email addresses and sensitive attributes indicates these measures were insufficient to prevent unauthorised access.","NIS2 requires entities to implement incident handling and security measures proportionate to the risk; a breach affecting nearly 12 million individuals signals that Capcom's protective measures did not adequately reflect the risk profile of operating a large-scale consumer identity service.","CIS Control 3 mandates identifying, classifying, and protecting sensitive data through encryption and access controls; encrypting stored PII such as email addresses, dates of birth, and IP addresses would have rendered the stolen data far less exploitable.","SI-2 directs organisations to identify, report, and correct information system flaws; had a systematic flaw remediation process been in place, the underlying vulnerability enabling unauthorised access to the CAPCOM ID database could have been discovered and patched proactively.","An effective incident response plan — including rapid user notification, forced credential resets, and post-incident analysis — is essential when a breach of this scale occurs, as timely and structured response limits harm to affected users.","This control requires organisations to systematically identify and remediate technical vulnerabilities in their systems; a robust vulnerability management programme could have identified and closed the security weaknesses that enabled the breach before attackers exploited them.","This function requires controls around who can access systems and data; stronger authentication and access restrictions on the CAPCOM ID database could have prevented or significantly limited the data exfiltration."]