Capcom says hackers took data tied to 11.7 million CAPCOM ID accounts

Japanese game publisher Capcom has disclosed a breach of CAPCOM ID, the shared account system people use to sign in to its web services and play some of its games online. Capcom says it detected suspicious activity on October 19 and confirmed unauthorized access the same day. By the next day, it was clear that customer information had been taken. The attackers obtained 11,774,247 records worldwide. Each record contains an email address and account data: the creation date, the time of the last login, the number of logins, and the IP address used for the most recent sign-in. For 43 of those records, the exposed data also includes date of birth, gender, country or region, and nickname. Capcom says it has found no evidence that passwords set by customers were compromised, and payment card information was not affected. The attackers did change the passwords on 196 accounts, and the company has since reset them. BleepingComputer reports that the password changes appeared to be an attempt to lock owners out. Capcom says all services that use CAPCOM ID remain available. It has begun contacting affected customers and has set up a dedicated contact point. Help Net Security advises players to be wary of emails that appear to come from the company, because the stolen addresses could be used for phishing. Capcom is known for franchises including Resident Evil, Street Fighter, Monster Hunter and Mega Man.