The Capcom data breach exposed 11,774,247 records from the company’s CAPCOM ID account system. “Records” is not the same as people, though. Capcom hasn’t said how many unique users that covers, so the 11.7 million figure in headlines is a loose shorthand. One person with two accounts could count twice.
Capcom, the company behind Resident Evil, Street Fighter and Monster Hunter, says credit card information was not among the affected data. According to Capcom’s official notice, players can still log in and play, too.
What was taken in the Capcom data breach
For most of the records, the exposed data is thin. According to Help Net Security, it covers email addresses plus account-activity data. That means when the account was created, the last login time, the number of logins and the IP address of the most recent sign-in.
However, a small group got hit harder. For 43 of those records, the exposed data also included date of birth, gender, country or region, and nickname.
The 196 accounts in the Capcom account leak that got worse
Here is the part that deserves a closer look. Capcom says an unknown party changed passwords without authorization on 196 accounts. Some outlets reported 193, but Capcom’s own notice says 196, so that is the number to trust.
Capcom has not confirmed that attackers compromised the passwords customers originally set. Still, someone changing a password means someone else was in the driver’s seat.
On Oct. 23, Capcom added a sharper detail in its update to the notice. The intruder also reached the e-Capcom account pages of 19 of those accounts. For those 19, the exposed information includes:
- Name and phonetic name
- Phone number, postal code and address
- Gender and date of birth
- Purchase history and customer inquiry history
- Saved address book information
Capcom says its investigation into the scope of the password changes is complete. It will keep monitoring CAPCOM ID and related services.
Why this Capcom security breach makes your email a target
An email address sounds harmless. It isn’t. A list of 11 million addresses tied to a gaming company is a ready-made phishing list, and phishing is a growing problem across the board, as the Quest Diagnostics patient records breach showed. Your email address is also the front door to your bank, your shopping and your other game accounts, so scammers only need one click.
Capcom itself warned that scammers could use the data to send fraudulent messages posing as Capcom or related parties. It asked users to “refrain from accessing any URLs contained therein or opening any attached files,” as quoted by Help Net Security. In plain English: if a Capcom email shows up begging you to verify your account, don’t click it. Go to the website yourself.
CAPCOM ID is more than a login for a newsletter. According to the company, it is a unified account that works across Capcom’s web services, and some titles, including Street Fighter 6, require it for online play. That is why this Capcom ID breach reaches so far into the player base.
What Capcom says it did, and what you should do now
Capcom says it began blocking access and investigating the moment it saw suspicious activity, and it has addressed the attack method. According to Engadget, the company reported the incident to local police and its external advisory board for security oversight. It will notify affected customers directly.
Meanwhile, you can protect yourself in a few minutes. Change your CAPCOM ID password, turn on two-step verification if it’s offered, and stop reusing that password anywhere else. Then watch your inbox.
What we still don’t know matters just as much. Capcom hasn’t named the attacker, explained how they got in, or said how long they had access. No group has claimed responsibility in the sources reviewed, and no regulatory action or lawsuit has surfaced yet.
The timing is awkward for the industry, too. Engadget notes this comes after Rockstar Games confirmed a “third-party data breach” in April. Gaming accounts are turning into a favorite target, and attackers are getting more creative, as the AI agent attack on South Korean banks suggests.
The next fake Capcom email may look a lot more convincing than the last one. Will you spot it before you click?
