On October 23, Capcom released its second update regarding the unauthorized access incident involving CAPCOM IDs. The company confirmed that third parties accessed the personal pages of 19 member accounts on the Japanese e-commerce site e-Capcom, resulting in the leakage of personal data. The compromised information includes names, addresses, and purchase histories, but does not include credit card details.
The previous day, Capcom disclosed that approximately 11.77 million email addresses and system-specific identification information worldwide were affected, and the login passwords of 196 accounts were illegally changed. Further investigation revealed that the e-Capcom personal pages of 19 of these accounts were accessed, all of which were domestic Japanese accounts.
Capcom stated that no further personal data leaks were discovered among the remaining accounts whose passwords were changed. The company has completed its investigation into the scope of the incident and will continue to monitor CAPCOM ID and related services. Measures to prevent recurrence are being implemented, and the information security system is being strengthened. Affected users will receive individual notifications in due course.
The company also warned that the leaked information could be used to impersonate Capcom or related organizations via text messages, phone calls, and suspicious emails. Users are advised not to click links in unsolicited messages or open suspicious attachments. The 19 confirmed accounts refer specifically to Japanese accounts where personal pages were accessed and additional data was leaked; this figure is distinct from the approximately 11.77 million records affected by the exposure of basic information.