Capcom, the Japanese publisher behind Resident Evil, Monster Hunter and Street Fighter, has disclosed that someone gained unauthorized access to CAPCOM ID, its unified player account system, and exposed more than 11.7 million account records worldwide. On 196 of those accounts, the intruder went further and changed the password without the owner's permission.
The company says it discovered the incident on October 19, has addressed the method the attacker used, and plans to notify affected customers. Games and online services remain available. The breach was flagged to players by Malwarebytes in its write-up of Capcom's notice.
Emails and IP addresses, not card numbers
According to Capcom's disclosure, the exposed data includes email addresses, account activity details and IP addresses. A much smaller set of records also contained personal details such as dates of birth. Capcom says credit card information was not affected, and it has not confirmed that the passwords customers originally chose were compromised.
Two caveats matter. First, the 11.7 million figure counts affected records, so the number of distinct people may be lower. Second, Capcom is still investigating, including how the 196 passwords were changed and whether anything else happened on those accounts. That leaves an open question about whether the attacker had a way to act on accounts directly rather than only read data.
A breach built for phishing
CAPCOM ID links to PlayStation, Xbox, Steam, Epic Games and Nintendo accounts, which makes it a useful pivot for anyone trying to reach a player's wider gaming identity. Email addresses paired with real account activity are exactly the ingredients scammers need for messages that look like they come from Capcom, the kind that ask players to "verify" an account or hand over a sign-in code.
Gaming accounts are a steady target. Fake game downloads remain a favourite delivery route for infostealers, as in a recent campaign that hid its loader behind a blockchain trick, and Japanese platforms have had a difficult year, including the Gyazo leak of 23.6 million accounts. More on the national picture is on our Japan country profile.
Turn on two-factor and go to cid.capcom.com yourself
- Enable two-factor authentication on CAPCOM ID from the Account page. Capcom recommends Google Authenticator or Microsoft Authenticator.
- Do not click links in breach-themed emails. If a message says your account needs attention, open a browser and go to cid.capcom.com directly. Capcom warns users not to follow URLs or open attachments in suspicious messages.
- Check your account, especially if you received an unexpected password-change notice. Review registered details and linked platform accounts, and use "Forgot your password?" if you cannot sign in.
- Use Capcom's official regional support contacts listed in its breach notice, never contact details supplied in an unexpected message.
The stolen data here is not the dangerous part on its own. What turns 11.7 million email addresses into real losses is the follow-up message that arrives looking exactly like Capcom, and that is the one players need to be ready for.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.