Capcom 11 774 247 ta CAPCOM ID yozuvini butun dunyo bo'ylab ta'sir qilgan ma'lumotlar buzilishini tasdiqladi. Ruxsatsiz uchinchi tomon uning onlayn a'zolik xizmatiga bog'liq mijoz ma'lumotlariga kirishgan.
2026-yil 22-oktabrda e'lon qilingan ushbu hodisa elektron pochta manzillari va hisob metama'lumotlarini ochib qo'ygan. Yozuvlarning kichik qismi shaxsiy profil ma'lumotlari va ruxsatsiz parol o'zgartirishlarini ham o'z ichiga olgan.
CAPCOM ID — bu foydalanuvchilarga Capcom veb-xizmatlariga kirish va ayrim o'yinlarni onlayn o'ynash imkonini beruvchi yagona hisob tizimi. Kompaniya muvaffaqiyatli ravishda favqulodda cheklov choralarini amalga oshirganini va CAPCOM ID xizmatlari yoki o'yinchilarning o'yinlarga kirish va o'ynash qobiliyatida hech qanday uzilish bo'lmaganini aytdi.
Ta'sirlangan yozuvlar elektron pochta manzillarini va Capcom tizimga xos identifikatorlar deb ta'riflagan boshqa ma'lumotlarni o'z ichiga olgan. Bu ma'lumotlar hisob yaratish vaqtlari, oxirgi kirish vaqtlari, kirish sonlari va eng so'nggi kirish bilan bog'liq mijoz IP manzilini o'z ichiga olgan.
Jami yozuvlar orasida 43 ta yozuv tug'ilgan sana, jins, mamlakat yoki mintaqa va taxalluslarni ham ochib qo'ygan. Capcom 196 ta hisobga ta'sir qilgan ruxsatsiz parol o'zgartirishlarini aniqlagan, bu hodisa ham hisob o'zgartirishlarini, ham mijoz ma'lumotlariga kirishni o'z ichiga olganini ko'rsatadi.
Capcom ushbu 196 ta hisobning parollarini qayta o'rnatgan, ammo mijozlarning asl kirish parollari buzilganini tasdiqlamagan. Ruxsatsiz parol o'zgartirishlari hujumchilar foydalanuvchilarning asl parollarini qo'lga kiritganini anglatmaydi. Shuningdek, ta'sirlangan ma'lumotlar kredit karta ma'lumotlarini o'z ichiga olmagan.
Capcom 19-oktabrda shubhali faoliyatni aniqlagan va darhol ruxsatsiz kirishni to'sib, hodisaning sababi va ko'lamini tekshirgan. Tergovchilar o'sha kuni kirishni tasdiqlagan, bu esa hujumga qarshi favqulodda choralarni ko'rishga undagan.
20-oktabrda Capcom ichki hodisaga javob berish jamoasini tuzgan. Ularning tekshiruvi mijoz ma'lumotlari ochilganini va ruxsatsiz parol o'zgartirishlari sodir bo'lganini tasdiqlagan. Kompaniya shuningdek, tashqi maslahat organi — Axborot texnologiyalari xavfsizligi nazorati qo'mitasiga xabar bergan.
21-oktabrda Capcom hodisani Osaka prefekturasi politsiyasiga va Yaponiyaning Shaxsiy ma'lumotlarni himoya qilish komissiyasiga xabar qilgan. Kompaniya buzilishning to'liq ta'sirini baholashda monitoring va tekshiruv sa'y-harakatlari davom etmoqda.
Capcom ochilgan ma'lumotlar kompaniya yoki tegishli tashkilotlar nomidan yuborilgan fishing elektron pochta xabarlari yoki boshqa firibgarlik aloqalarini qo'llab-quvvatlash uchun ishlatilishi mumkinligi haqida ogohlantirgan. Mijozlarga shubhali xabarlardagi ilovalarni ochmaslik yoki havolalarga amal qilmaslik tavsiya etiladi. Ro'yxatdan o'tgan elektron pochta manzillari hali ham ishlatilishi mumkin.
Capcom hujum usulini aniqlagan va bartaraf etganini da'vo qilsa-da, e'lon dastlabki kirish qanday sodir bo'lgani, aniq zaifliklar yoki zararli dasturlar ishtirok etgan-etmagani yoki hujumchilar kimligi haqida ma'lumot bermaydi.
Kompaniya ta'sirlangan mijozlar bilan alohida bog'lanadi va mintaqaviy qo'llab-quvvatlash kanallarini tashkil etgan. Shuningdek, u qo'shimcha tekshiruv o'tkazish, kelajakdagi hodisalarni oldini olish choralarini joriy etish, axborot xavfsizligi nazoratini kuchaytirish va yangi tegishli ma'lumotlar paydo bo'lishi bilan qo'shimcha ommaviy yangilanishlarni taqdim etish majburiyatini olgan.
Capcom has confirmed a data breach that affects 11,774,247 CAPCOM ID records worldwide. Anunauthorized third party accessed customer information linked to its online membership service.
This incident, disclosed on October 22, 2026, exposed email addresses and account metadata. A smaller subset of records also included personal profile information and unauthorized password changes.
CAPCOM ID is a unified account system that allows users to access Capcom web services and play certain games online. The company said it successfully implemented emergency containment measures, and there has been no disruption to CAPCOM ID services or players’ ability to access and play its games.
The affected records contained email addresses along with other data that Capcom described as system-specific identifiers. This data included account creation timestamps, last login times, login counts, and the client IP address associated with the most recent login.
Among the total records, 43 also exposed dates of birth, gender, country or region, and nicknames. Capcom identified unauthorized password changes affecting 196 accounts, indicating that the incident involved both account modifications and access to customer information.
Capcom has reset the passwords for those 196 accounts but has not confirmed any compromise of customers’ original login passwords. Unauthorized password changes do not necessarily mean attackers obtained users’ original passwords. Additionally, the affected data did not include credit card information.
Capcom detected suspicious activity on October 19 and immediately began blocking unauthorized access while investigating the incident’s cause and scope. Investigators confirmed the intrusion on the same day, prompting emergency measures to address the attack.
On October 20, Capcom established an internal incident response team. Their investigation confirmed that customer information had been exposed and that unauthorized password changes had occurred. The company also notified its external advisory body, the Information Technology Security Oversight Committee.
On October 21, Capcom reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. Monitoring and investigation efforts are ongoing as the company assesses the breach’s full impact.
Capcom warned that the exposed information could be used to support phishing emailsor other fraudulent communications impersonating the company or related organizations. Customers are advised to avoid opening attachments or following links in suspicious messages. Registered email addresses can still be used.
Although Capcom claims to have identified and addressed the attack method, the notice does not disclose how the initial access occurred, whether specific vulnerabilities or malware were involved, or who the attackers were.
The company will contact affected customers individually and has established regional support channels. Additionally, it has committed to conducting a further investigation, implementing measures to prevent future incidents, enhancing information security controls, and providing additional public updates as new relevant information becomes available.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.