Capcom announced on Monday, November 16, it had become the victim of a ransomware attack and verified that “some personal information maintained by the Capcom Group has been compromised.”

It had sent out a press release on November 4 saying its networks had experienced issues due to “unauthorized access carried out by a third party.”

The November 16 statement, however, points to “additional personal and corporate information” having been potentially compromised in the attack.

The statement outlines two main data sets: data confirmed to have been compromised and data potentially compromised as a result of the attack.

The information verified to have been compromised includes 9 items. These are the following:

• The personal information of former employees: 5 items (Name & signature: 2 items; name & address: 1 item; passport information: 2 items)
• The personal information of existing employees: 4 items (Name and HR information: 3 items; name & signature: 1 item)
• Other information, including sales reports and financial information.

Potentially compromised data includes far more items, and includes:

• Personal information (customers, business partners, etc. totalling about 350,000 people)
  • Japan: Customer service video game support help desk information (approximately 134,000 people) – Names, addresses, phone numbers, email addresses
  • North America: Capcom Store member information (approximately 14,000 people) – Names, birthdates, email addresses
  • North America: esports operations website members (approximately 4,000 people) – Names, email addresses, gender information
  • List of shareholders (approximately 40,000 people) – Names, addresses, shareholder numbers, amount of shareholdings
  • Former employees’ (including family) information (approx. 28,000 people) and applicants’ information (approximately 125,000 people) – Names, birthdates, addresses, phone numbers, email addresses, photos, etc.
• Personal information (employees and related parties)
  • The human resources information of approximately 14,000 people
• Confidential corporate information
  • Sales data, business partner information, sales documents, development documents, etc.

None of the accessed data includes credit card information, as these are handled by a third-party service provider, Capcom said.

“Because the overall number of potentially compromised data cannot specifically be ascertained due to issues including some logs having been lost as a result of the attack, Capcom has listed the maximum number of items it has determined to potentially have been affected at the present time,” the company added, which means up to a maximum of 350,000 people may have been affected by the attack.

Capcom explained it got a message from the Ragnar Locker ransomware group demanding a ransom for the stolen information. The company has reported the issues to the requisite agencies as per the European Union’s General Data Protection Regulation and the Personal Information Protection Commission of Japan.

It is now working with law enforcement agencies in Japan and the US, and has “commissioned a third-party security company to inspect system issues stemming from this incident. Capcom plans to announce the results of this inspection separately, when available.”

Despite the attack, Capcom says its games are safe to play, and that its websites remain accessible to the public. – Rappler.com