A number of services run by Capcom and Square Enix have been subject to unauthorized access attacks by third-party individuals and groups, part of a wave of AI-based cybersecurity breaches at Japanese companies in recent weeks.
On October 19, Square Enix confirmed that a number of Final Fantasy XIV the accounts had been accessed by an anonymous third party. According to the developer, access to the accounts was not the result of a direct breach of Square Enix’s security and databases, but due to this third party using credentials collected during other companies’ security breaches to access these accounts. The company has already moved to prevent access to accounts it believes could be compromised, but warned that it may enforce password resets and security measures on all accounts if such breaches continue to increase.
Meanwhile, Capcom revealed yesterday that a direct breach of databases and services containing user information had occurred, resulting in access to account information and system ID email addresses for more than 11.7 million users. Specifically, in at least 43 cases, access to user information, including date of birth, gender and location, was violated, and in approximately 196 accounts, passwords were illegally changed. This flaw occurred on October 19 and the vulnerability was immediately fixed internally. An investigation was carried out to find out the cause of this offense, all information was passed on to the police.
Notably, these two incidents are not the only cases of cybersecurity breaches targeting Japanese companies in recent weeks. The Japanese government is exploring methods to deal with the growing number of violations at companies across all sectors, with cases of such violations in 2026 already surpassing last year’s total. Many of these breaches were powered by AI systems.
The regularity of these violations is a reminder to ensure that your passwords are not repeated between services and that you update all passwords at regular intervals. If the service supports it, two-factor authentication should also be applied to further secure your personal data and to ensure that data acquired in one company’s breach cannot later be used to access your accounts elsewhere.
Gn tech
