Japanese Game Maker Capcom Has Confirmed – 11,774,247 Customer Records Exposed
Capcom confirms 11.7M customer records exposed via CAPCOM ID service.
Run Capcom?
Get an email when a reviewed story names Capcom, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Japanese game maker Capcom has announced that its CAPCOM ID service was accessed without authorization, exposing 11,774,247 customer records worldwide. The exposed data includes email addresses, account activity details, and for a smaller subset, dates of birth and gender. Attackers also changed passwords on 196 accounts, which Capcom has since reset.
The lesson from this incident
Full lessonAttackers gained unauthorized access to Capcom's CAPCOM ID service, exposing nearly 12 million customer records including email addresses, account activity, dates of birth, and gender data. The breach was compounded by attackers successfully changing passwords on 196 accounts, indicating insufficient authentication controls or monitoring around privileged account actions. This incident highlights the critical need for robust access controls, anomaly detection, and proper data minimization practices. When a gaming platform stores personal data at this scale, the impact of a single access control failure becomes massive, affecting millions of users worldwide.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.