Timeline per Capcom's notice: suspicious activity spotted and access confirmed Oct 19, an internal incident HQ stood up Oct 20, and police plus Japan's Personal Information Protection Commission notified Oct 21. The disclosure went out through Capcom's investor relations page today. CAPCOM ID services and the games themselves stayed up.
The record set is thin, but it's the useful kind for a follow-on campaign. Email plus last-login time plus last-login IP is exactly what makes a "we noticed a sign-in from your location" phish believable. Capcom says customer-set passwords weren't confirmed exposed. The 196 changed passwords show the attacker could write to accounts, not just read them, and Capcom has reset those.
What I'd do if I ran security for a consumer identity platform this week: check whether your account-recovery and password-change paths can be driven by an admin or support API that doesn't go through the user's own session. A small number of forced password changes next to a bulk metadata pull usually points that way. If you're a SOC with staff who game on work email, push a heads-up about Capcom-branded mail before the lures land.
Context: this is Capcom's second big incident in six years. In 2020 Ragnar Locker hit the company, and Capcom later said the way in was an old VPN device. How the attacker got in this time hasn't been shared.