Capcom has confirmed that an unauthorized third party accessed customer data tied to CAPCOM ID, the shared account used for the company's web services and for online play in some of its games. According to Capcom's official notice, a massive 11,774,247 records were affected worldwide, each containing an email address along with the account creation date, last login time, login count, and the IP address from the most recent sign-in. Capcom spotted the suspicious activity on October 19, started blocking it the same day, and reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21. A much smaller group of 43 records also exposed dates of birth, gender, country or region, and nicknames.

The attackers changed the login passwords on 196 accounts too, and Capcom has since reset them. A follow-up notice on October 23 adds that the intruder opened the e-Capcom store pages of 19 of those accounts, exposing names, phone numbers, addresses, and purchase history for those customers in Japan. Capcom says it found no sign that customer-set passwords were compromised, and credit card information was not affected. Capcom hasn't said how the attackers got in, only that the method has been identified and dealt with. CAPCOM ID and Capcom's games remain available. The bigger risk now seems to be phishing, so anyone with a CAPCOM ID is advised to treat messages claiming to come from Capcom with suspicion.