Capcom data breach exposes 11.7 million CAPCOM ID accounts
Capcom has confirmed a data breach of CAPCOM ID, its shared membership service, exposing more than 11.7 million customer email addresses and related account details, according to BleepingComputer. The company says passwords for most members and credit card data were not exposed, but how the attackers got in has not been disclosed.
What we know
BleepingComputer, citing Capcom’s own alert, reports the following sequence:
- Capcom detected suspicious activity and confirmed unauthorized access on October 19, and began an investigation immediately.
- By the following day it was clear that customer information had been compromised.
- On October 21 the company reported the incident to the police and to Japan’s Personal Information Protection Commission.
- Capcom says it identified the intrusion method and put measures in place to prevent a repeat. No details of the initial access have been shared.
The timing of the breach itself remains unclear. Capcom says its online services are unaffected.
Who is affected
CAPCOM ID is the account system used to reach Capcom web services and to play some of its online games. Capcom publishes franchises such as Resident Evil, Monster Hunter, Street Fighter and Mega Man, so the affected pool is large and global.
The exposed data for the full set of more than 11.7 million accounts:
- Email address
- Account creation date
- Last login timestamp
- Number of logins
- IP address used at the last login
A smaller group was hit harder. For 43 accounts, dates of birth, gender, nicknames and countries were also exposed. For another 196 accounts, the attackers changed the CAPCOM ID login password, apparently to lock the owners out. Capcom says it took action and reset those passwords.
Capcom says passwords for all other registered members were not exposed and that credit card information was unaffected. It plans to notify affected customers in stages and has set up region-specific channels for support requests.
What has not been confirmed
- When the intrusion started and how long the attackers had access: not disclosed.
- The initial access method: not disclosed.
- Who is responsible: no group has been named in the reporting.
- Whether the data is being sold or published: not stated.
Why this matters
This section is our analysis, not new reporting.
An email address plus a last-login IP and login count is useful raw material for targeted phishing. A message that references a real Capcom account looks more credible than a generic lure, and Capcom itself warns about unsolicited emails, URLs and attachments. The 196 forced password changes show the attackers could act on accounts, not just read data, which is worth treating as a sign of intent to take over accounts.
For a typical organisation the direct risk is low, but staff who use work email addresses to register for gaming services can bring phishing exposure to your mail gateway. Capcom has previously been breached: BleepingComputer notes a November 2020 ransomware attack claimed by the Ragnar Locker gang, and an April 2021 disclosure that attackers had entered through an old VPN device.
What to do
- If you have a CAPCOM ID: treat any email that mentions Capcom, your account or a password reset with suspicion, and do not open unexpected links or attachments. Go to the official site directly instead.
- Change your password if you reused it anywhere else, and enable any extra sign-in protection Capcom offers. Capcom says passwords were not exposed for most accounts, but reuse is cheap to fix.
- Watch for Capcom’s notice. Notifications are going out in stages, so a later email may be genuine. Verify it through Capcom’s official support channels before acting.
- Security teams: consider a short awareness note to staff about gaming-themed phishing, and check mail logs for lures that mention Capcom or CAPCOM ID.
- Check back for updates. Capcom has not yet explained the intrusion method, and we will update this story if it does.
Related free tool: test how long a password would take to crack with our Password Strength Checker. It runs entirely in your browser and nothing you type is sent or stored.
