Capcom, the Japanese publisher behind franchises such as Street Fighter and Monster Hunter, has confirmed a data breach affecting nearly 11.8 million CAPCOM ID accounts worldwide. CAPCOM ID is the company’s unified login system, used to access various web services and online games, including Street Fighter 6.
According to a notice from Capcom reported by BleepingComputer, the company first detected suspicious activity on October 19 suggesting unauthorized third-party access to the system. It immediately began blocking access while it investigated, and formed an internal task force the following day.
What was exposed
Capcom says the breach affected a total of 11,774,247 CAPCOM ID records. For the vast majority of those accounts, the exposed data was limited to email addresses and system-level metadata: account creation dates, last login times, login counts, and the IP address used at the most recent login.
A much smaller subset, 43 accounts, had additional personal information exposed, including date of birth, gender, country or region, and nickname. Capcom has not said whether those users have been contacted individually, but the company has publicly disclosed the scope of the exposure.
Separately, attackers managed to change the login passwords on 196 accounts without authorization. Capcom says it has since reset all 196 of those passwords, though it has not confirmed whether users’ original, self-set passwords were exposed or leaked in the process. The company says no credit card or payment information was included in the breach, and that services using CAPCOM ID, including gameplay access, remained available throughout.
Capcom’s history with breaches
This marks only the second major security incident Capcom has disclosed publicly. In November 2020, the company suffered a ransomware attack, attributed in some reports to the Ragnar Locker group, that exposed hundreds of thousands of records belonging to customers, business partners and former employees.
Capcom has reported the latest incident to Japanese police and to the country’s Personal Information Protection Commission, and has urged CAPCOM ID users to be cautious of phishing emails that may attempt to impersonate the company in the breach’s aftermath.
No credit card or payment information was included among the leaked data, Capcom said in its official notice.
The company has not detailed the geographic breakdown of affected accounts, and it remains unclear how many European users fall within the 11.8 million figure. Affected users are advised to change their CAPCOM ID passwords as a precaution and to remain alert to unsolicited emails referencing the breach.
This article is free to read. It always will be — no paywall, no account, no tracking.
