Capcom has confirmed that a data breach of its CAPCOM ID online membership service has affected 11,774,247 accounts worldwide. The Japanese publisher said a third party gained unauthorised access to the system, exposing email addresses and system-specific identifier information including account creation dates, last login times and client IP addresses.
The breach was first detected on Monday 19 October, when Capcom noticed suspicious activity and immediately blocked access while launching an investigation. By Wednesday, the company had reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission.
What Information Was Exposed
According to Capcom’s official statement, the breach affected three categories of data. The largest group, encompassing all 11,774,247 records, had email addresses and system identifiers compromised. These identifiers include the date and time of account creation, the date and time of last login, number of logins and the IP address used during the most recent session.
Of those accounts, 43 had additional personal information exposed, including date of birth, gender, country or region, and nickname. Capcom said this represents a tiny fraction of the total affected users.
Key detail: No credit card information was included in the breach. Capcom confirmed that payment data remained secure throughout the incident.
The company also discovered that 196 accounts had their login passwords changed without authorisation. Capcom stressed that no customer-set passwords were compromised, and all 196 affected passwords have already been reset by the company.
Capcom’s Response Timeline
Events moved quickly once the breach was detected. On Monday, Capcom confirmed the unauthorised access and implemented emergency measures before the day ended. Tuesday saw the formation of an internal incident response headquarters tasked with gathering information and assessing the scope of affected data.
By Wednesday, the company had reported the breach to both law enforcement and Japan’s data protection authority. Dedicated customer support channels have been opened for all affected regions, with contact details published for Japan, the Americas, EMEA and Asia-Pacific.
“Capcom takes this matter extremely seriously and will continue its detailed investigation. Based on the findings of the investigation, it will implement measures to prevent recurrence and further strengthen its information security framework.”
What Affected Users Should Do
Capcom warns that affected users may receive suspicious emails impersonating the company or similar organisations, attempting to phish account details or install malware. The company advises against clicking any URLs or opening attachments in unexpected messages.
All CAPCOM ID services remain available, and Capcom states the incident does not affect players’ ability to access or play any of its games. Users with a CAPCOM ID, required for online features in titles like Street Fighter 6 and Monster Hunter, should remain vigilant but can continue using the service normally.
A Familiar Pattern for Capcom
This marks the second major data breach Capcom has suffered. The company previously faced a significant cyberattack in 2020 that exposed employee and customer data. That incident led to prolonged investigations and regulatory scrutiny.
The scale of this latest breach, affecting nearly 12 million accounts globally, underscores the ongoing challenge game publishers face in securing user data. Capcom’s statement promised strengthened security measures, though the company did not specify what changes would be implemented beyond the emergency procedures already in place.
For players, the immediate action is straightforward: watch for suspicious emails, consider updating passwords as a precaution, and monitor Capcom’s official channels for further updates as the investigation continues.
