The Capcom Data Breach Hit 11.7 Million CAPCOM ID Accounts

What Happened in the Capcom Data Breach

Capcom has disclosed a major data breach affecting more than 11.7 million accounts on its CAPCOM ID service. The Japanese game publisher said unauthorized third-party access on October 22 exposed 11,774,247 email records worldwide, along with account metadata: date of account creation, usernames, last login date and time, number of logins, and the client IP address used during the last login.

The Capcom data breach also exposed a smaller set of more personal records. Forty-three accounts had birth dates, gender, country or region, and nicknames leaked. Capcom confirmed 196 unauthorized password changes and says it has already reset those passwords. Login passwords originally set by customers were not compromised, the company said, and no credit card information leaked.

Capcom detected signs of possible unauthorized access on October 19, formed an internal response team, confirmed the data leaks and password changes on October 20, and reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21. The company has notified affected users directly.

Why Gamers Should Pay Attention

CAPCOM ID is the account system behind Capcom's online services, covering titles like Street Fighter 6, Resident Evil Requiem, Onimusha: Way of the Sword, and Pragmata. If you have ever registered for a Capcom beta, linked a game account, or signed up for Capcom news, you may be in the 11.7 million.

The leaked data is not the worst-case kind. Nobody's payment details or plaintext passwords are circulating. But 11.7 million email addresses tied to a gaming service is prime material for phishing. Capcom itself warned users to watch for fraudulent emails impersonating the company and to avoid clicking links or attachments in suspicious messages. That warning is the part to take seriously: the next email claiming to be from Capcom about "securing your account" is exactly the kind of message attackers will now send, because they know your address came from Capcom's own database.

The 196 unauthorized password changes are the sharpest edge of the incident. Someone used the access to take over accounts, which means at least some of the exposed data was weaponized quickly. If you reuse passwords across services, this is the breach that should finally break the habit.

A Rough Month for Japanese Companies

The Capcom data breach lands in a grim stretch for Japanese corporate security. Nikkei disclosed its third breach in about a month after attackers used stolen credentials to access a development system, exposing 1.83 million records (details here). The Japan Times confirmed an Eclipse ransomware attack that put 20 years of data from a retired server into public view. Something is systematically wrong when the country's biggest media company, its paper of record, and its biggest game publisher all disclose incidents within days of each other.

The common thread is credential-based access, not exotic zero-days. Nikkei's attackers used stolen login details. Capcom describes "unauthorized third-party access." The lesson is unglamorous: the front door keeps getting left open.

What to Do If You Have a CAPCOM ID

Capcom says passwords were not compromised and most users do not need to change theirs. Still, treat this as a drill:

1. Change your CAPCOM ID password anyway. It costs two minutes and eliminates the residual risk.
2. Turn on two-factor authentication on your CAPCOM ID and your email account, the one attackers will target next for password resets.
3. Expect phishing. Any email about Capcom, your account, or "urgent security action" in the next few months deserves extra suspicion. Go to the site directly instead of clicking.
4. Check whether your email appears in other breaches with a lookup service (here's how), and use a unique password everywhere (start here).

Capcom says players can keep using their registered email to play without interruption, which is the right call operationally. The incident response timeline, detection on the 19th, containment, police report on the 21st, public disclosure on the 22nd, is about as fast as these things go. Speed does not undo the leak, but it limits the window. The uncomfortable truth remains: 11.7 million email addresses are now in circulation, and no incident response can take them back.