Capcom is warning players about phishing after unauthorized access to its CAPCOM ID service exposed more than 11.7 million records worldwide, including email addresses and information about account activity. The company behind Resident Evil says passwords for 196 accounts were changed without permission and that it has since reset them. Capcom says credit card details were not affected.
The exposed data also included IP addresses, while a much smaller subset of records held personal information such as birth dates. The total counts records rather than individual users, so the number of people affected may be lower than 11.7 million. Capcom has not confirmed whether the breach compromised passwords that customers had originally selected.
Capcom detected the incident on October 19 and says it has dealt with the method used to gain access. Its games and services continue to operate, and the company intends to contact customers affected by the breach. Capcom is still examining the impact, including how the 196 password changes happened and whether those accounts experienced additional unauthorized activity.
CAPCOM ID provides a shared sign-in system across Capcom websites and services, with support for online functionality in some games. Players can connect it to accounts on gaming platforms such as Steam, PlayStation and Nintendo. Malwarebytes warns that the leaked information could make fraudulent messages impersonating Capcom more believable, helping scammers persuade recipients to surrender passwords or verification codes.
Capcom advises users to avoid links and attachments in messages that appear suspicious. Anyone receiving an email demanding account action should navigate independently to the CAPCOM ID website and check there, rather than following the message's instructions. Players who receive an unexpected password-change notification should inspect their registered details and connected gaming accounts through their Account page.
Users can enable two-factor authentication from their Account page with a smartphone or tablet, adding a code generated by an authenticator app when signing in. Capcom suggests Microsoft Authenticator or Google Authenticator for that step. Players unable to access their accounts can use the password recovery option, while those needing assistance should obtain regional support contacts through Capcom's breach notice instead of an unsolicited message.
