Capcom reports unauthorized access to 11.7 million CAPCOM ID records
Capcom has disclosed that an unauthorized party accessed data tied to CAPCOM ID, affecting 11,774,247 records worldwide. The exposed information included email addresses and account metadata, while 43 records also contained birth date, gender, region, and nickname. Capcom said passwords were not compromised, but attackers changed 196 account passwords, which the company reset; payment card data was not affected.
Capcom spotted suspicious activity on October 19 and confirmed the intrusion that day. It then formed an internal incident-response team, briefed an outside IT security oversight committee, and notified Osaka police and Japan’s privacy regulator. The company says its emergency response is complete, the attack method has been addressed, and CAPCOM ID and its games remain online.
Capcom intends to contact affected users and has set up regional support channels, including a Japanese toll-free line and online forms for the Americas and EMEA. Its investigation continues, and no group has claimed responsibility. The publisher previously faced a 2020 ransomware incident affecting up to 350,000 people; Rockstar Games also confirmed an April attack claimed by ShinyHunters.
The incident could mainly affect CAPCOM ID holders worldwide, especially those whose email addresses and account details were exposed. Because stolen contact data may make impersonation messages more convincing, users could face phishing attempts or account-takeover scares, even though Capcom says passwords were not compromised. The 196 unauthorized password changes may heighten anxiety and support demand. More broadly, repeated gaming-industry breaches may erode confidence in account security and encourage users to scrutinize login alerts and unsolicited messages.