Capcom hack exposes 11.7 million email addresses: what Resident Evil players should watch for

On October 19, suspicious activity appeared on CAPCOM ID, the single account the Japanese publisher of Resident Evil and Monster Hunter offers for its web services and some of its online games. Capcom blocked access the same day and confirmed an intrusion. The next day, it found that customer data had left the company. On October 22, it went public: 11,774,247 accounts worldwide are affected.

For almost all of them, the leak involves the email address and technical information: account creation date, date and number of logins, and the IP address of the last login. For 43 accounts, the date of birth, gender, country and username were also exposed. Capcom says payment cards are not affected and that it found no trace of passwords being leaked.

196 players locked out of their accounts

One detail shows the intruders did more than just read data. On 196 accounts, they changed the password, which stopped the owners from logging in. Capcom has reset those accounts. The publisher has not said how the hackers got in. According to BleepingComputer, it says it has identified the method and strengthened its defenses. The perpetrators have not been publicly identified. On October 21, Capcom notified the police and Japan's personal data protection commission.

The publisher has been attacked before. In November 2020, the Ragnar Locker ransomware hit it. As Capcom explained in April 2021, the hackers got in at the time through an old VPN device, BleepingComputer recalls.

The real risk: far too convincing emails

An email address, the date of the last login and the IP address used: that is enough to write a convincing fake “Capcom” security alert. The publisher itself warns that suspicious messages could impersonate it or related companies. A few precautions:

• do not open any link or attachment in an unexpected message claiming to come from Capcom; to log in, type the service's address yourself;
• if you can no longer log in, you may be one of the 196 reset accounts: contact Capcom Europe customer support (or Capcom USA if you are in the Americas);
• your registered email address can still be used, Capcom says;
• as a simple precaution, if you used that password elsewhere, change it there too.

Given the number of accounts, Capcom will email affected players in successive waves. The investigation continues, and the publisher promises to post any confirmed new development on its website. The main question remains unanswered: how did the hackers get in?