Capcom Says CAPCOM ID Breach Hit 11.7 Million Records

Capcom says an unauthorized party accessed 11,774,247 CAPCOM ID records worldwide, mostly email addresses paired with login metadata, in an intrusion it detected on October 19. Profile details were exposed for 43 accounts, 196 accounts had their passwords changed without authorization, and no credit card information was affected, according to Capcom's notice published October 22.

"Capcom sincerely apologizes for the complications and concern this has caused its customers and other stakeholders," the company said. CAPCOM ID and its games remain available, and Capcom says the incident doesn't affect players' access.

The main risk Capcom flags is phishing. It says registered email addresses can keep being used, but warns customers to watch for emails or messages impersonating Capcom and not to open links or attachments in suspicious ones. It's the second gaming-adjacent data incident we've covered in recent months, after the CEVA Logistics breach that hit Pokémon and Valve customers in August.

The details

• Records accessed: 11,774,247 (email addresses, account creation and last login times, login counts, last-login IP address)
• Profile data: birth date, gender, country/region and nickname for 43 accounts
• Password changes: unauthorized on 196 accounts; Capcom has reset them
• Customer-set passwords: not confirmed compromised
• Credit cards: not affected

How did Capcom respond?

Capcom blocked the access and began emergency measures on October 19. On October 20 it set up an internal incident response headquarters, confirmed that customer information had been accessed and some passwords changed, and reported to its external Information Technology Security Oversight Committee. On October 21 it notified the Osaka Prefectural Police and Japan's Personal Information Protection Commission.

Where can players get help?

Capcom has set up regional contacts:

• Japan: toll-free 0120-801-271, 10 a.m. to 8 p.m. JST
• Americas: the Capcom USA customer support inquiry form
• EMEA: the Capcom Europe support form or [email protected]
• Asia (excluding Japan) and Oceania: [email protected]

Capcom detected the intrusion on a Sunday and reported it to police by Tuesday. The servers stayed up the whole time.