What happened

Game publisher Capcom has confirmed that an external party accessed the databases behind its CAPCOM ID player accounts on 19 October, affecting 11,774,247 records. The exposed data includes email addresses, login IDs, account dates, login counts and recent IP addresses.

Capcom says no passwords or payment card details were taken, and its games are unaffected. The attacker did change the passwords on 196 accounts.

Why it matters

Gaming and entertainment platforms hold millions of player accounts, making them prime targets. Even without passwords, emails and login IDs fuel phishing and credential-stuffing campaigns against players.

How to protect your AWS environment

• Keep player databases in private subnets, never reachable directly from the internet.
• Encrypt account data at rest and restrict database access to the services that need it.
• Monitor for bulk queries or exports from account databases and alert on them immediately.

Source: Click to Read the original report (Help Net Security)

‍