Capcom ID data breach: 11.7 million email addresses leaked; Capcom says passwords and card details were not taken

Capcom says 11,774,247 email addresses linked to its Capcom ID accounts were leaked in a security breach, along with each account's creation date, last login date, login count and the IP address of the most recent login, ARY News reported from the company's statement on Thursday 22 October. Capcom, the Japanese publisher of Resident Evil, Street Fighter and Monster Hunter, says no credit card information was taken and there is no evidence that original passwords leaked.

What was exposed

Timeline

• 19 October: Capcom noticed signs of unauthorised access and began blocking it.
• 20 October: it set up an internal task force.
• By 21 October: it reported the breach to the police and to Japan's Personal Information Protection Commission.

Capcom has not said how the attackers got in. It says it is still investigating and is contacting affected customers.

What to do if you have a Capcom ID

1. Treat Capcom-looking emails with suspicion. With 11.7 million addresses out, phishing is the main risk: do not click login links in emails, open the site or app yourself.
2. Change your password if you reused your Capcom password anywhere else, starting with your email account.
3. Turn on two-step verification on your email, Steam, PlayStation and Xbox accounts.
4. If you got an email from Capcom saying your password was reset, you are one of the 196 accounts the attacker changed; follow only the steps on Capcom's own site.

The same week, a flaw in PHP took government websites offline in Europe: our report on the PHP security flaw.