Japanese video game company Capcom has confirmed that attackers breached its CAPCOM ID membership service and exposed more than 11.7 million email addresses. Account creation dates, last-login details and the IP address of the latest sign-in were also exposed, and for 196 accounts the attackers changed the password. The company says other members' passwords and card details were not affected. The intrusion was detected on 19 October and reported to the police and to Japan's data protection authority.

What it means: A breach that involves only email addresses and login details is often played down, but this data is the raw material for targeted phishing. An attacker knows the recipient holds an account with a specific service and when they last signed in, which makes a convincing password reset lure easy to build. For Greek businesses that run customer accounts, such as online shops, booking platforms or subscription apps, the case shows what should be ready before something similar happens. Firms need a record of which fields they store and why, so they do not keep unnecessary data such as old IP addresses. They also need a notification plan, because the GDPR requires the Hellenic Data Protection Authority to be told within 72 hours and, when the risk is high, the users themselves. The password changes on 196 accounts show the attackers also tried account takeover, which two-factor authentication and alerts on every password change make much harder. Finally, notifying millions of customers in stages is an operational task in its own right, so message templates and support channels are best prepared in advance.

Read the original on BleepingComputer

Related service: Custom software

Related stories