Capcom has confirmed that intruders breached CAPCOM ID, the shared account system for its web services and some online games, exposing more than 11.7 million customer email addresses together with account creation dates, last-login timestamps, login counts and the IP address used at last login. A subset of 43 accounts also had dates of birth, gender, nicknames and countries exposed, and in 196 accounts the attackers changed login passwords in an attempt to lock owners out; Capcom reset those accounts. The company says no other passwords and no credit card data were exposed. Capcom detected suspicious activity and confirmed unauthorised access on 19 October, established the scope of the data loss the following day, and reported the incident to police and Japan's Personal Information Protection Commission on 21 October. Affected customers will be notified in stages. Capcom's 2021 breach, which exposed customer and employee data, was traced to an old VPN appliance.

• Source article