Capcom Confirms Data Breach Exposed Users’ Personal Information
In a notice published October 22, the Japanese company said customer information associated with CAPCOM ID was subject to unauthorized access by a third party.
In a notice published October 22, the Japanese company said customer information associated with CAPCOM ID was subject to unauthorized access by a third party.
What they found was a global campaign which targeted corporate Microsoft 365 environments with adversary-in-the-middle (AiTM) attacks , which allowed the attackers to compromise accounts without the attacker ever needing to steal the passwords associated with them.
By October 21, Capcom had completed emergency response measures and identified and addressed the attack method and reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
It also confirmed that credit card information remains unaffected by the breach.
Despite the tech sector causing the vast majority of individual data breach victims, it was only the seventh most commonly breached sector.
Identified by cybersecurity researchers at Huntress, the campaign used fake sign-in pages, device-code phishing, stolen session tokens and social engineering in attacks which appeared to be setting the stage for BEC BEC attacks .
In October 2026, it was reported that a Chinese nation-state actor gained access to IT management software provider ConnectWise’s cloud infrastructure, enabling the group to target downstream customers.
These campaigns have included threat actors accessing the personal details of Booking.com customers and spoofing the company’s email domains to send malicious messages.
In October 2026, CrowdStrike reported that a China-based threat actor used ARTEX to discover vulnerabilities and compromise specific services in South Korean financial organizations, a campaign that resulted in the exfiltration of data.
While Symantec researchers said none of the techniques used by the attackers in this campaign are novel, their combination into a single, self-directed agent lowers the skill required for other attackers to run a broad exploitation campaign.
What happened
In a notice published October 22, the Japanese company said customer information associated with CAPCOM ID was subject to unauthorized access by a third party.
What they found was a global campaign which targeted corporate Microsoft 365 environments with adversary-in-the-middle (AiTM) attacks , which allowed the attackers to compromise accounts without the attacker ever needing to steal the passwords associated with them.
What changed
By October 21, Capcom had completed emergency response measures and identified and addressed the attack method and reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
It also confirmed that credit card information remains unaffected by the breach.
Who is affected
Despite the tech sector causing the vast majority of individual data breach victims, it was only the seventh most commonly breached sector.
Identified by cybersecurity researchers at Huntress, the campaign used fake sign-in pages, device-code phishing, stolen session tokens and social engineering in attacks which appeared to be setting the stage for BEC BEC attacks .
Why it matters
In October 2026, it was reported that a Chinese nation-state actor gained access to IT management software provider ConnectWise’s cloud infrastructure, enabling the group to target downstream customers.
These campaigns have included threat actors accessing the personal details of Booking.com customers and spoofing the company’s email domains to send malicious messages.
Technical details
In October 2026, CrowdStrike reported that a China-based threat actor used ARTEX to discover vulnerabilities and compromise specific services in South Korean financial organizations, a campaign that resulted in the exfiltration of data.
While Symantec researchers said none of the techniques used by the attackers in this campaign are novel, their combination into a single, self-directed agent lowers the skill required for other attackers to run a broad exploitation campaign.
The attackers then replayed the stolen tokens from their own machines in automated sign-in attempts against Microsoft 365 services.
Response
Microsoft reported a ClickFix campaign that impersonated Booking.com in March 2025.
In an update published on October 21, ConnectWise acknowledged Microsoft’s findings and the extensive use of AI to compromise its Microsoft365 tenants.
What security teams should do
Among the focus areas of the investigation, the Commission will assess whether Booking.com has diligently assessed and mitigated phishing risks to customers.
Attribution
Infosecurity Magazine: In a notice published October 22, the Japanese company said customer information associated with CAPCOM ID was subject to unauthorized access by a third party.
Infosecurity Magazine: Identified by cybersecurity researchers at Huntress, the campaign used fake sign-in pages, device-code phishing, stolen session tokens and social engineering in attacks which appeared to be setting the stage for BEC BEC attacks .
Infosecurity Magazine: Of those individuals, most (79%) had their data accessed following the compromise of a technology company during the period June 2025 to June 2026.
Infosecurity Magazine: The investigation will ascertain whether the online travel agency has breached security and transparency provisions contained in the EU’s Digital Services Act (DSA).
What to watch next
Watch for new exploitation reports and updated indicators of compromise.