Capcom and Square Enix Hit by Cyber Attacks, Exposing Player Data

Recently, several services operated by Capcom and Square Enix have fallen victim to unauthorized access attempts by various individuals and groups, highlighting a troubling trend of AI-driven cybersecurity breaches affecting Japanese companies.

On October 19, Square Enix confirmed that multiple Final Fantasy XIV accounts had been compromised by an unidentified third party. The developer clarified that this incident did not stem from a direct breach of its own security systems but rather from the use of credentials obtained through breaches at other companies. In response, Square Enix has proactively restricted access to potentially compromised accounts and indicated that it may implement password resets and additional security measures across all accounts if these incidents continue to rise.

In a related incident, Capcom announced that it experienced a direct breach affecting databases and services that store user information, compromising the account details and email addresses of over 11.7 million users. Alarmingly, in at least 43 instances, sensitive user data such as date of birth, gender, and location were accessed, and passwords were illegally altered in approximately 196 accounts. This breach was also reported on October 19, with the vulnerability promptly addressed internally. An investigation is underway to determine the breach’s cause, and all relevant information has been forwarded to law enforcement.

These incidents are part of a broader wave of cybersecurity breaches targeting Japanese firms. The Japanese government is actively exploring strategies to combat the increasing frequency of these attacks across various sectors, with the number of breaches in 2026 already exceeding the total for the previous year. Many of these attacks have been facilitated by AI technologies.

This ongoing situation serves as a crucial reminder to regularly update your passwords and avoid reusing them across different services. Enabling two-factor authentication wherever possible can significantly enhance the security of your personal data, helping to prevent the misuse of information obtained from one breach to access your accounts elsewhere.