Capcom confirms data breach affecting 11.7 million accounts
Capcom says a CAPCOM ID breach exposed data linked to more than 11.7 million accounts, while passwords and payment details were not broadly affected.
Capcom has confirmed that hackers accessed its CAPCOM ID membership service and exposed information connected to more than 11.7 million accounts. The company says the exposed data included email addresses, account creation dates, last-login timestamps, login counts and the IP address used at the last login. 12
Capcom’s official notice says a smaller group of 43 accounts also had dates of birth, gender, nicknames and countries exposed. In a separate group of 196 accounts, attackers changed login passwords in an apparent attempt to lock people out; Capcom says it reset those passwords. 1
The company says passwords for other registered members were not exposed and that credit-card information was unaffected. Capcom detected suspicious activity on 19 October, confirmed unauthorised access during its investigation, and reported the incident to police and Japan’s Personal Information Protection Commission on 21 October. 12
CAPCOM ID is the shared account system used for Capcom’s web services and some online games. Capcom says its online services remain available, but it is warning users to be careful with unexpected messages, links and attachments. The company plans to contact affected customers in stages and has set up region-specific support channels. 1
The incident is separate from Capcom’s 2020 ransomware attack, when attackers claimed to have stolen a much larger volume of internal data. Capcom later said that earlier intrusion involved an old VPN device, but the company has not disclosed the initial access method for this latest CAPCOM ID breach. 2
Our opinion
The most important distinction here is between what Capcom has confirmed and what remains unknown. The scale is alarming, but the company says passwords and payment details were not exposed for the wider membership base. That does not make the incident trivial: email addresses and account history can still fuel convincing phishing attempts, especially when tied to gaming services people already trust. Capcom’s staged notifications should be clear about who is affected, what each person’s data contained and what action is required. Until those messages arrive, users should treat unsolicited CAPCOM ID emails as suspicious and avoid clicking through from the message itself.