[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqpRHFoR_KtnYoMO53GRdp0fQWSScqQJjIkbSXVJqq1Y":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"6d7178e1-463b-465e-830d-e73aff046da2","capcom-id-breach-exposes-117-million-user-records","f77fc3fa-9f1e-4c30-afd1-48ce101273f7","Capcom ID Breach Exposes 11.7 Million User Records","Capcom's CAPCOM ID service suffered a significant data breach that exposed nearly 12 million email addresses along with associated account metadata such as login timestamps and IP addresses, with a subset of users also losing sensitive personal data like dates of birth and gender. This incident highlights the critical importance of minimising the personal data stored in user account systems — a principle known as data minimisation — so that when breaches occur, the blast radius is limited. The exposure of IP addresses and login behaviour data further compounds the risk, enabling secondary attacks such as credential stuffing or targeted phishing. Gaming platforms and consumer-facing services are high-value targets precisely because they aggregate large volumes of personal data, making robust access controls, encryption at rest, and strict data retention policies essential safeguards.","**Immediate actions:**\n- Enforce password resets for all affected accounts and notify impacted users with clear guidance on protective steps they should take.\n- Audit all data fields stored in the CAPCOM ID system and delete or anonymise any fields that exceed operational necessity (apply data minimisation principles).\n\n**Long-term improvements:**\n- Implement strong encryption at rest for all personally identifiable information (PII) stored in account databases, ensuring that stolen data is unusable without decryption keys.\n- Adopt a data minimisation and retention policy that limits the collection of sensitive attributes (e.g., date of birth, gender, IP history) to only what is strictly required for service operation.\n- Enforce multi-factor authentication (MFA) on all CAPCOM ID accounts to reduce the impact of credential exposure.\n\n**Detection measures:**\n- Deploy anomalous access detection and rate-limiting on authentication endpoints to identify and block credential stuffing or bulk data exfiltration attempts in near real-time.\n- Establish continuous logging and alerting for large-scale data access events, ensuring that unusual query volumes or bulk exports trigger immediate security review.",[12,13,14,15,16,17,18],"GDPR Article 32","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 3: Data Protection","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(b)",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"CIS Control 3: Data Protection":22,"NIST SP 800-53 SI-2: Flaw Remediation":23,"CIS Control 17: Incident Response Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Article 32 requires organisations to implement appropriate technical and organisational measures to protect personal data; the exposure of 11.7 million email addresses and sensitive attributes indicates these measures were insufficient to prevent unauthorised access.","NIS2 requires entities to implement incident handling and security measures proportionate to the risk; a breach affecting nearly 12 million individuals signals that Capcom's protective measures did not adequately reflect the risk profile of operating a large-scale consumer identity service.","CIS Control 3 mandates identifying, classifying, and protecting sensitive data through encryption and access controls; encrypting stored PII such as email addresses, dates of birth, and IP addresses would have rendered the stolen data far less exploitable.","SI-2 directs organisations to identify, report, and correct information system flaws; had a systematic flaw remediation process been in place, the underlying vulnerability enabling unauthorised access to the CAPCOM ID database could have been discovered and patched proactively.","An effective incident response plan — including rapid user notification, forced credential resets, and post-incident analysis — is essential when a breach of this scale occurs, as timely and structured response limits harm to affected users.","This control requires organisations to systematically identify and remediate technical vulnerabilities in their systems; a robust vulnerability management programme could have identified and closed the security weaknesses that enabled the breach before attackers exploited them.","This function requires controls around who can access systems and data; stronger authentication and access restrictions on the CAPCOM ID database could have prevented or significantly limited the data exfiltration.","published","2026-10-24T12:20:50.835436+00:00","2026-10-24T12:20:50.807+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fsecurityaffairs.com\u002F201626\u002Fdata-breach\u002Fcapcom-data-breach-exposes-11-7-million-email-addresses.html","capcom-data-breach-exposes-11-7-million-email-addresses-39668b","Capcom Data Breach Exposes 11.7 Million Email Addresses",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":54,"name":55,"problem":56},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":58,"name":59,"problem":60},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]