Capcom has urged CAPCOM ID users to remain vigilant against potential phishing attempts following the breach.
Capcom has confirmed a major data breach affecting more than 11.7 million CAPCOM ID records worldwide, exposing customer information and resulting in unauthorised password changes to nearly 200 accounts.
The Japanese gaming giant, known for franchises such as Resident Evil, Monster Hunter, and Street Fighter, revealed in an official statement that its online membership service CAPCOM ID had been targeted by an unauthorised third party. The company confirmed that customer information had been compromised, although gameplay and online services remain unaffected. CAPCOM ID is a unified account system used to access Capcom's various online services and play certain games online.
What happened in the Capcom data breach?
Capcom first detected suspicious activity involving its CAPCOM ID system on Monday (19 October), which led to the discovery of unauthorised access to the service. The company moved to block the intrusion and launched an investigation to determine how the attackers had gained access.
By Tuesday (20 October), the investigation had confirmed that customer information had been compromised. Capcom also discovered that the attackers had managed to change the login passwords of several accounts without their owners' authorisation. The incident was reported to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on Wednesday (21 October), before Capcom publicly disclosed the breach the following day.
While the publisher has since identified and addressed the method used in the attack, it has not revealed how the attackers initially gained access to the system or who was responsible.
Who was affected by the Capcom data breach?
A total of 11,774,247 CAPCOM ID records worldwide were affected by the breach, exposing account information belonging to users of the publisher's online membership service. The impact went beyond exposed account information for some users. Capcom confirmed that 196 accounts had their login passwords changed without authorisation, although the company has since reset these passwords to secure the affected accounts.
Further investigation also uncovered additional exposure involving 19 of those accounts, as detailed in a follow-up announcement. The attackers had used these accounts to access their associated pages on e-Capcom, the publisher's Japanese online store, where additional customer information was exposed.
Capcom clarified that these 19 accounts were already among the 196 accounts affected by unauthorised password changes, rather than a separate group of victims. The investigation also found no further information compromised through the password changes in the remaining accounts.
What customer information was exposed in the Capcom data breach?
The compromised information primarily consisted of registered email addresses and account-related data associated with CAPCOM ID.
The exposed information includes:
- Email addresses registered with CAPCOM ID
- Account creation dates and times
- Dates and times of the most recent login
- Number of account logins
- IP addresses used during the most recent login
Of the 11.7 million affected records, 43 contained additional personal information, including dates of birth, gender, country or region, and nicknames.
Meanwhile, the 19 affected e-Capcom accounts had more sensitive personal information exposed, including customers' names, telephone numbers, postal codes, addresses, purchase histories, customer enquiry histories, and saved address book information. Dates of birth, gender, and names written in Japanese phonetic characters were also among the affected details.
Despite the unauthorised password changes, Capcom has not confirmed any compromise of the original login passwords set by customers themselves. Credit card information was also not included among the compromised data.
Are Capcom games and online services affected by the data breach?
Capcom has assured players that the data breach will not disrupt their gaming experience, with its games and online services continuing to operate as usual. "Additionally, this incident does not affect players' ability to access or play any of our games," the publisher said in its initial statement. CAPCOM ID accounts also remain accessible, and users do not need to change their registered email addresses.
For the 196 accounts that experienced unauthorised password changes, Capcom has already reset their passwords to prevent further access. The publisher has also completed its emergency security measures and addressed the method used in the attack. Its latest update confirmed that the investigation into the extent of the breach had concluded, although Capcom will continue monitoring its services and strengthening security to prevent another incident.
What should CAPCOM ID users do following the data breach?
While Capcom has addressed the security incident, the potential misuse of stolen customer information remains a concern, particularly for CAPCOM ID users whose email addresses were exposed. The publisher has warned that the compromised information could be used in phishing attempts, with scammers potentially posing as Capcom representatives through emails, text messages, or phone calls.
"There is a possibility that the affected information could be misused in fraudulent texts, phone calls, or other communications to impersonate Capcom or related parties," the publisher warned. CAPCOM ID users should therefore be particularly careful with unexpected messages claiming to be from Capcom, especially those asking them to follow suspicious links, open unfamiliar attachments, or provide personal information. Capcom has also begun contacting affected customers individually and established dedicated support channels for those who have concerns about their accounts or personal information.
Users in Asia, excluding Japan, and Oceania can reach Capcom through [email protected]. Meanwhile, customers in the Americas, Europe, the Middle East, and Africa can submit enquiries through the Capcom customer support page.
Although Capcom's investigation has concluded, users are still encouraged to remain vigilant against suspicious communications that could exploit information obtained during the breach.
