Capcom Breach Exposes 11.7 Million Accounts, Company Warns of Phishing Risk
The Resident Evil and Street Fighter publisher says attackers accessed login and account data but not passwords or payment information.
Capcom is telling customers to watch their inboxes after disclosing that a third party accessed its Capcom ID membership system on October 19, exposing data tied to more than 11 million accounts.
The company behind Resident Evil, Monster Hunter, and Street Fighter said 11.7 million email address records were affected worldwide. Along with the email addresses themselves, the exposed data included when each account was created, the date and time of the last login, how many times the account had logged in, and the IP address used during that last login.
A much smaller slice of accounts saw more sensitive exposure. Capcom said 43 records included date of birth, gender, country or region, and nickname. Separately, 196 accounts had their Capcom ID login passwords changed without authorization. Capcom has already reset the passwords on those accounts and says it's still working to determine the full scope of the damage.
The company was careful to draw a line around what wasn't touched. Passwords that customers set themselves were not leaked, according to Capcom, and no credit card information was part of the breach. Capcom also said it doesn't expect the incident to affect its games directly.
Still, the company is urging caution. Because attackers now have working email addresses and account activity details for millions of users, Capcom warned that information could be used to craft convincing phishing emails. Customers can keep using the email addresses tied to their Capcom ID, the company said, but it told users to be wary of unexpected messages. "If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files," Capcom advised.
Capcom has reported the breach to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission, the country's data privacy regulator. The company hasn't detailed how the intrusion happened, but said it has completed emergency response measures and identified the attack method used.
Capcom characterized the breach as a serious matter and said its investigation is ongoing. The company said any findings will inform steps to prevent a repeat and to shore up its information security more broadly, and it committed to posting updates on its official website if new details emerge. It closed its statement with an apology: "Capcom would once again like to express its sincere apologies to its customers and all other stakeholders."
For now, the practical advice for Capcom ID holders is straightforward: don't click links or open attachments in unsolicited emails claiming to be from Capcom, and keep an eye on the company's official channels for updates as the investigation continues.
