If you play Monster Hunter, Street Fighter or Resident Evil online, expect your inbox to deserve extra suspicion for a while. Japanese publisher Capcom has confirmed that an outsider broke into data linked to Capcom ID, the account players need for many of its online services. In total, 11,774,247 records around the globe are affected.
Most of what leaked is an email address paired with background details: when the account was created, the time of the most recent login, how many logins there have been, and the IP address used last. For just 43 users, the stolen data went further and also revealed their date of birth, gender, home country and screen name. In 196 cases, the intruders went further and changed account passwords, which Capcom has since reset. The company says it has found no evidence that passwords chosen by customers themselves were stolen, and no credit card data was involved.
Capcom spotted the suspicious activity on 19 October and blocked it the same day. A response team was set up on the 20th, and a day later Capcom informed the police in Osaka as well as the national privacy regulator. Games and other Capcom ID services kept running throughout.
The bigger risk now, the company warns, is phishing. Anyone holding the leaked addresses could send convincing fake messages that appear to come from Capcom, so users are told not to click links or open attachments in anything that looks odd. Affected players will be contacted directly, and changing your password is a cheap precaution regardless.
Capcom is not alone. The same day, internet services firm GMO Internet disclosed a possible breach of its own, the newest entry in a string of cyberattacks on Japanese companies.
