Capcom Breach Exposes 11 Million Accounts via CAPCOM ID Platform

Capcom has confirmed a data breach affecting over 11 million users of its CAPCOM ID service, the centralised login system the company uses for online gaming and related services. The breach was detected on 19 October.

The attackers made off with email addresses belonging to 11,774,247 accounts, plus ancillary data including account creation dates, login counts, last login timestamps, and the IP address tied to the most recent session. Not catastrophic on its own, but a solid dataset for anyone looking to run phishing campaigns against gamers.

For a smaller subset of 43 users, the damage went further. Those accounts had dates of birth, gender, country or region details, and display nicknames exposed. Modest numbers, but worth noting that even a handful of fully profiled individuals represents a real-world harm.

More concerning is that the attackers actively changed passwords on 196 accounts during the intrusion. Capcom insists that no raw passwords were exposed and says it has already reset credentials for the affected users. Whether that distinction comforts anyone whose account was tampered with mid-breach is another matter.

Capcom says all CAPCOM ID-dependent services stayed online throughout, which is at least something. The company has notified relevant authorities, set up a dedicated support contact for affected users, and started reaching out to those impacted.

The standard breach advice applies: if you use CAPCOM ID, treat any unexpected emails claiming to be from Capcom with suspicion, particularly ones carrying links or attachments you were not expecting.

Capcom has pledged to investigate root causes and improve its security posture. Which is exactly what every company says after getting breached, so we will see how that plays out.