Capcom Data Breach Exposes Nearly 12 Million Customer Records

Capcom disclosed on October 22 that a third party gained unauthorized access to its CAPCOM ID online account system, exposing email addresses and login metadata tied to nearly 11.8 million customer records worldwide.

The Japanese game publisher, known for franchises including Street Fighter, Resident Evil, and Monster Hunter, said it first detected suspicious activity on October 19 and confirmed the breach the same day. Emergency containment measures have been completed, and the company says it has identified and addressed the method of attack.

The bulk of the compromised data consists of 11,774,247 records containing email addresses along with system-level identifiers including the date and time of account creation, the date and time of the most recent login, total login count, and the IP address used during the last login. A much smaller subset of 43 records also included dates of birth, gender, country or region, and nicknames. Capcom confirmed that credit card information was not among the affected data.

It was also discovered that 196 CAPCOM ID accounts had their login passwords changed without the owners’ authorization. Capcom stressed that it has not confirmed any compromise of the passwords that customers themselves originally set, but it has already reset the credentials on those 196 as a precaution.

Once the breach was identified, they began blocking the unauthorized access while investigating the cause and stood up an internal incident response headquarters to confirm the access of certain data.

Services remain operational

CAPCOM ID is a unified account system that lets registered users access various Capcom web services and is required for online play in certain titles. Capcom said all games and CAPCOM ID-linked services remain fully available and that the breach does not affect players’ ability to access or play any of its titles.

The company warned affected customers to watch for phishing attempts. Because email addresses were among the exposed data, there is a risk that bad actors could send fraudulent messages impersonating Capcom or related parties. Capcom advised customers to avoid clicking links or opening attachments in any suspicious communications.

A dedicated support lines has been set up for for affected users, including a toll-free number and regional contacts in Japan, North and South America, EMEA, and Asia-Pacific.