The Capcom Hack Affected Way More People Than Originally Reported

Capcom, the legendary Japanese video game developer and publisher behind such classics as Street Fighter and Resident Evil, has been recovering since a November ransomware hack saw a “customized attack” on the company’s internal networks.

At the time, Capcom divided its estimate of the damages from the attack into two categories: the confirmed and the hypothetical. The company reported that it could only verify that nine people had their data compromised as a result of the attack, though there was a chance, it said, that some 350,000 people may have had their information compromised.

Well, apparently that initial estimate was way off: a new update from the company shows the estimate jumping from nine confirmed compromises to 16,415. On top of that, approximately 40,000 more people than originally suspected have been moved into the “maybe” category, with the projection jumping from 350,000 “potential compromises” to some 390,000.

This drastic shift in numbers is not all that surprising, given that it can often take quite awhile for a company to figure out just how screwed they actually are after a ransomware attack. Post-incident investigations are frequently time-consuming and not all of the information is typically available right away.

Most of the newly confirmed cases are not consumer-related and relate instead to former Capcom employees (9,164), current employees (3,994), and a certain percentage of business partners (3,248 people). The information that was exposed includes documents like sales reports, game development documents, financial information, and “other information related to business partners.”

A silver lining is that no consumer credit card information was compromised in the attack. A third-party vendor handles all of Capcom’s online financial transactions, leaving that data safely out of reach of the hackers, the company reported.

“Capcom would once again like to reiterate its deepest apologies for any complications or concerns caused by this incident,” the company said in a statement Tuesday. “As a company that handles digital content, it is regarding this incident with the utmost seriousness. In order to prevent the reoccurrence of such an event, it will endeavor to further strengthen its management structure while pursing legal options regarding criminal acts such as unauthorized access of its networks.”

The company also reported that it was “in large part recovered, and business operations have returned to normal.” It also continues to work with law enforcement while the investigation into the hack is ongoing.