Capcom has disclosed a data breach affecting 11.7 million CAPCOM ID accounts worldwide, exposing email addresses and account activity information.
Attackers also changed passwords on 196 accounts, which the company has since reset.
In its announcement, the Japanese game publisher said it discovered signs of unauthorized access on October 19. Capcom immediately blocked the suspicious access and began investigating, confirming the intrusion that same day and implementing emergency countermeasures.
Capcom, the company behind franchises including Resident Evil, Monster Hunter, and Street Fighter, operates CAPCOM ID as a shared account service for its websites and certain online games. The company says services using the account system remain available, and gameplay across all its games is unaffected.
The investigation has identified 11,774,247 affected records globally. The exposed information includes registered email addresses, account creation timestamps, last login timestamps, login counts, and the client IP address recorded during the most recent login.
For 43 of those accounts, the breach exposed additional profile information, including dates of birth, gender, country or region, and nicknames. Capcom says the breach did not include credit card information.
The company has not confirmed any exposure of customer-set passwords. However, it found that passwords for 196 affected accounts had been changed without authorization. Capcom has reset those passwords and continues to investigate the extent of the intrusion’s impact.
The announcement does not explain how the attackers gained access or how they were able to change account passwords. Although Capcom says it has identified and addressed the attack method, it has not publicly disclosed the technical details or identified those responsible.
On October 20, Capcom established an internal response headquarters to coordinate information gathering and prevent further damage. Investigators confirmed the customer information leak and unauthorized password changes that day, and the company notified its external advisory body.
Capcom reported the incident to police and Japan’s Personal Information Protection Commission on October 21. Monitoring and further investigation are ongoing, and Capcom is contacting affected customers individually.
The exposed email addresses create a risk of follow-up phishing attempts. Capcom warned that attackers could exploit the leaked information to send messages impersonating the company or its partners, and urged customers to avoid links and attachments in suspicious communications.
Customers should access CAPCOM ID directly to check their accounts and handle any password reset, particularly if they receive an unexpected security notification. Requests to provide login credentials or payment details through an unsolicited email should be treated with caution.
Leave a Reply