Capcom Confirms Data Breach Affecting 11.7 Million CAPCOM ID Accounts
Japanese video game giant Capcom has confirmed that hackers infiltrated its CAPCOM ID membership service and accessed the email addresses and related information of more than 11.7 million customers.
What information was exposed?
The compromised data includes customer email addresses, account creation dates, last-login timestamps, login counts, and the IP address used during the most recent login.
Capcom said additional information—including dates of birth, gender, nicknames, and countries—was exposed for a small number of accounts. The company identified 43 accounts in this category.
Hackers also changed the CAPCOM ID login passwords for 196 accounts, locking out their owners. Capcom said it reset those passwords.
In today’s alert, Capcom said that passwords for all other registered members were not exposed and that credit card information was not affected.
When did Capcom discover the breach?
The timing of the initial intrusion remains unclear. Capcom detected suspicious activity and confirmed unauthorized access on October 19.
The company launched an investigation immediately and determined by the following day that customer information had been compromised. Capcom notified the police and Japan’s Personal Information Protection Commission on October 21.
Capcom warns users about phishing attempts
Capcom said its online services remain unaffected, but warned users to be cautious of unsolicited communications and emails requesting additional information. The company also advised customers to avoid messages containing suspicious URLs or attachments.
As part of its investigation, Capcom identified the method used to gain access and implemented security measures intended to prevent similar incidents. However, the company did not disclose details about the initial access.
Capcom said it will notify affected customers in phases, likely because of the large number of impacted accounts. The company has also established region-specific communication channels for support requests.
What is CAPCOM ID?
CAPCOM ID is Capcom’s shared account system for accessing the company’s web services and playing some online games.
Capcom is a Japanese video game developer and publisher known for franchises including Resident Evil, Monster Hunter, Street Fighter, and Mega Man. The company has 4,000 employees and annual revenue of $1.24 billion.
Capcom’s previous ransomware attack
In November 2020, Capcom was attacked by the Ragnar Locker ransomware group. The attackers claimed to have stolen 1TB of data, and Capcom later warned that up to 390,000 people could be affected.
In April 2021, Capcom revealed that the attackers had gained access through an outdated VPN device.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com