Capcom has confirmed that an outside party got into CAPCOM ID, the free account service behind the online features of many of its games, and accessed records tied to 11,774,247 accounts worldwide. In a notice and apology published on October 22, the Osaka publisher said the exposed data is mostly email addresses and login metadata, that no credit card information was involved, and that it found no sign that customers' own passwords were taken. It did, however, find 196 accounts whose passwords had been changed by the intruder.
What was taken
Capcom splits the affected information into three tiers, all counted as of October 22.
The largest group, all 11,774,247 records, covers the email address registered to each account plus a set of what Capcom calls system-specific identifiers: the date and time the account was created, the date and time of the last login, the total number of logins, and the client IP address used for that last login. On its own that is not enough to sign in to anyone's account, but an email address paired with a recent IP address and a record of how often someone plays is exactly the kind of detail that makes a phishing email look convincing.
A much smaller group of 43 records also included date of birth, gender, country or region, and the account nickname.
The third tier is the one that points to an active attacker rather than a passive data grab: 196 accounts had their CAPCOM ID login password changed without authorisation. Capcom says it has already reset the passwords on those accounts and is still investigating what else, if anything, happened to them. It stresses that it has not confirmed any compromise of the passwords customers set for themselves.
Payment card data was not part of the affected information, according to the company.
How it unfolded
Capcom laid out a short timeline. On October 19 it spotted suspicious activity pointing to possible unauthorised access to CAPCOM ID, began blocking that access straight away, and confirmed the same day that a breach had occurred. On October 20 it set up an internal incident response headquarters, confirmed that customer information registered to CAPCOM ID had been accessed and that a limited number of passwords had been changed, and briefed its external advisory body on IT security. On October 21 it reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission.
The company says it has now identified and dealt with the method of attack and finished its emergency response. It has not said how the intruder got in.
Can you still play?
Yes. Capcom is explicit that services using CAPCOM ID remain available and that the incident does not affect anyone's ability to access or play its games. CAPCOM ID is the unified account Capcom uses across its web services, and it is required for the online side of a number of its games, so a shutdown would have hit a large slice of the publisher's player base. Registered email addresses also keep working as normal; there is no forced migration or mandatory reset for the wider user base.
Capcom says it will contact the customers whose accounts were affected directly.
The real risk: emails pretending to be Capcom
The practical danger for most of those 11.7 million people is not that someone can log in as them today, but that a leaked email list with fresh login data is a ready-made target list for scams. Capcom itself warns that the information could be used to send fraudulent emails or other messages impersonating Capcom or related parties, and asks customers not to click links or open attachments in anything suspicious.
That advice cuts both ways at a moment when Capcom is about to start emailing affected users. A sensible rule for the next few weeks: if a message claims to be from Capcom about this breach, do not use its links. Go to Capcom's website or the CAPCOM ID site by typing the address yourself, and change your password there if you want peace of mind. If you reused your CAPCOM ID password anywhere else, changing it on those services too costs nothing.
Where to get help
Capcom has set up dedicated support channels for this incident by region. Japan has a toll-free support line, 0120-801-271, staffed from 10:00 a.m. to 8:00 p.m. JST. Players in North, Central and South America, and in Europe, the Middle East and Africa, are pointed to the inquiry form on Capcom's support site, with EMEA players also able to email Capcom Europe's feedback address. Asia (excluding Japan) and Oceania are handled by Capcom Asia's customer support email. Capcom says it will post further updates on its official website if more facts come to light.
Not Capcom's first breach
This is the second major security incident at Capcom in six years. In November 2020 the company disclosed a ransomware attack on its internal network that exposed personal data belonging mostly to employees, former employees and business partners, rather than player accounts. This time the target was the customer-facing account system itself, which is why the headline number is so much larger.
Capcom says it takes the matter extremely seriously, will keep investigating, and will put measures in place to prevent a recurrence and strengthen its information security once the investigation is complete. For now, the picture is a large but relatively shallow leak: millions of email addresses and login records, a few dozen more detailed profiles, a couple of hundred hijacked passwords that have been reset, and no payment data. The thing to watch is your inbox.
