A number of services run by Capcom and Square Enix have been the subject of unauthorized access attacks by third-party individuals and groups, part of a surge of AI-powered cybersecurity breaches of Japanese companies in recent weeks.
On October 19, Square Enix confirmed that a number of Final Fantasy XIV accounts had been accessed by an unnamed third party. According to the developer, access to the accounts was not the result of a direct breach of Square Enix’s own security and databases, but a result of this third party using credentials gathered from the security breaches of other companies to access these accounts. The company has already stepped in to prevent access to accounts it thinks may be compromised, but has warned that it may enforce password resets and security measures on all accounts if such breaches continue to increase.
Meanwhile, Capcom disclosed yesterday that a direct breach of databases and services containing user information had occurred, resulting in access to system-identifying account information and email addresses for over 11.7 million users. More notably, in at least 43 cases, access to user information including date of birth, gender, and location have been breached, and in roughly 196 accounts, passwords were illegally changed. This breach occurred on October 19th, with the vulnerability immediately fixed internally. An investigation was conducted to learn the cause of this breach, with all information being handed to police.
Notably, these two incidents are not the only cases of cybersecurity breaches targeting Japanese companies in recent weeks. The Japanese government is looking into methods to address the growing number of breaches for companies in all sectors, with cases of such breaches in 2026 already surpassing the total for all of last year. Many of these breaches have been powered by AI systems.
The regularity of these breaches is a reminder to ensure that your passwords are not repeated across services and that you update all passwords at regular intervals. If the service supports it, two-factor authentication should also be applied to make your personal data more secure, and to ensure that any data acquired in the breach of one company can’t then be used to break into your accounts elsewhere.