Capcom Says Intruders Took 11.7 Million CAPCOM ID Records, Warns Players of Phishing Risk

Japanese game publisher Capcom has disclosed that an unauthorised third party accessed customer data tied to CAPCOM ID, its shared online account system. The company says it spotted suspicious activity and confirmed the intrusion on October 19. According to its notice, 11,774,247 account records were taken worldwide, mostly email addresses paired with account activity data. The incident was reported by BleepingComputer, Help Net Security and SecurityWeek. Capcom says customer-chosen passwords and payment card details were not part of the stolen data. It is warning players that the leaked information could be used to send convincing fake emails that appear to come from the company.

What happened

Capcom is best known for franchises such as Resident Evil, Street Fighter, Monster Hunter and Mega Man. CAPCOM ID is the login people use for the company's web services and for playing some of its games online.

Here is the sequence of events Capcom has described, based on its notice as reported by the outlets:

1. October 19: Capcom detected suspicious activity and confirmed unauthorised access the same day. It began blocking the access and worked to identify how the attackers got in.
2. October 20: Help Net Security reports that the company set up an internal incident response headquarters. It also informed its Information Technology Security Oversight Committee, an external advisory body. BleepingComputer notes that by this point it was clear customer information had been compromised.
3. October 21: Capcom reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission, the country's data protection regulator.

Capcom says it has finished its emergency response. It has identified and addressed the method used in the attack, and has put measures in place to prevent similar incidents. It has not said what that method was. BleepingComputer points out that it remains unclear when the breach itself began. Capcom only says when it noticed the activity.

At the time of the reports, no group had claimed responsibility.

Who is affected

The breach affects holders of CAPCOM ID accounts worldwide. The company has set up support channels by region. These include a toll-free phone line in Japan and online inquiry forms for players in the Americas and in Europe, the Middle East and Africa (EMEA). It plans to notify affected customers. BleepingComputer reports that notifications will go out in stages, likely because of the sheer number of accounts.

The exposed data falls into three groups:

• Around 11.77 million records: email address, account creation date, time of last login, number of logins, and the IP address used for the most recent sign-in. An IP address is the network address a device uses online, and it can hint at a user's approximate location or internet provider.
• 43 of those records: also included date of birth, gender, country or region, and nickname.
• 196 accounts: had their passwords changed by the attackers without permission. Capcom has since reset them. BleepingComputer describes the changes as an apparent attempt to lock owners out of their accounts.

Capcom says CAPCOM ID services and its games remain available. Registered email addresses can continue to be used.

How it works

Capcom has not explained how the attackers got in, so there is no technical attack chain to describe. What can be explained is why this kind of data matters, even without passwords or card numbers.

The stolen dataset effectively confirms that a given email address belongs to an active Capcom customer. It also shows roughly how often that person plays and when they last signed in. Criminals can use these details for phishing, which means fraudulent messages designed to trick recipients into clicking malicious links, opening infected attachments or handing over login details. A message that mentions a real account, or a recent login, looks far more believable than a generic scam.

The 196 password changes show that the attackers were not limited to reading data. In at least some cases, they could alter account settings. Capcom says it found no evidence that the passwords customers had set themselves were compromised.

How serious is it?

By volume, this is a large breach. More than 11.7 million records is several times the scale of Capcom's previous major incident. The sensitivity of most records is moderate, however. For nearly all affected accounts, the data is limited to an email address and usage metadata. Passwords and payment data were not taken. More detailed personal information was exposed for only 43 accounts.

The three outlets agree on the core figures: the number of records, the data types, the 43 and 196 account subsets, and the October 19 detection date. SecurityWeek's coverage rounds the total to 11 million impacted.

The outlets differ on one historical detail. Both Help Net Security and BleepingComputer recall the November 2020 attack on Capcom. Help Net Security says that ransomware attack compromised data of up to 350,000 customers, business partners and employees. BleepingComputer puts the figure Capcom warned about at up to 390,000 people. BleepingComputer adds that the Ragnar Locker ransomware gang claimed the 2020 attack and said it had stolen 1 TB of data. Capcom later said, in April 2021, that those attackers got in through an old VPN device.

Help Net Security also notes that Capcom is not the only game company hit this year. Rockstar Games confirmed an attack in April that was claimed by the ShinyHunters group.

What to do now

For everyday players:

• Treat any email or message claiming to be from Capcom, or a related party, with suspicion. This is especially true if it asks for personal details or urges you to act quickly.
• Follow Capcom's own advice: do not open links or attachments in suspicious messages. The company asks users to "refrain from accessing any URLs contained therein."
• Go to Capcom's services directly rather than through links in emails.
• If you cannot log in to your CAPCOM ID, contact Capcom through the support channel for your region. You may be one of the 196 accounts whose password was reset.
• If you used the same password elsewhere, consider changing it as a precaution. Capcom says passwords were not exposed, but the investigation is ongoing.
• Watch for Capcom's direct notification. The company says it will contact affected customers.

For IT and security teams:

• Staff who use corporate email addresses for gaming accounts may now be easier phishing targets. Consider reminding employees about this.
• Watch inbound mail filters for Capcom-themed lures in the coming weeks.
• Use the incident as a reminder to discourage reusing work credentials on consumer services.

What we still don't know

• How the attackers got in. Capcom says it identified and fixed the attack method but has not described it.
• When the intrusion started. October 19 is when Capcom detected it. How long the attackers had access before that is unclear.
• Who is responsible. No group had claimed the attack when the reports were published.
• Why only 43 records included fuller profile data, and why the attackers changed passwords on exactly 196 accounts.
• Whether the data has been leaked or offered for sale. None of the sources report this either way.
• Whether more findings will emerge. Capcom says its investigation continues and that it will post updates on its website if further disclosures are needed.

ITVedas analysis: Capcom detected the intrusion, reported it to police and the regulator within two days, and disclosed it quickly, which is to its credit. Still, a second major breach in six years, together with silence on how this one happened, leaves players and partners guessing whether the root causes have truly been addressed. For most of the 11.7 million people affected, the real risk now is a convincing phishing email rather than the breach itself.