By Hamza Faisal
Japanese gaming giant Capcom has confirmed that hackers broke into its CAPCOM ID account system, exposing the data of more than 11.7 million accounts worldwide. The company says it first detected the intrusion on October 19 and publicly disclosed it on October 22, making it one of the largest gaming data breaches of the year.
CAPCOM ID is the free unified account players need to use Capcom's web services and to play certain games online, including the fighting hit Street Fighter 6. Across all 11,774,247 affected records, the exposed data includes the registered email address plus system-specific metadata: the date and time the account was created, the date and time of the last login, the number of logins, and the IP address used during that last login.
No passwords leaked, but 196 accounts were hijacked
Capcom says it has found no evidence that the passwords customers chose themselves were leaked. But the attackers did more than read data: they changed the passwords on 196 accounts without authorization, in an apparent attempt to lock the rightful owners out. Capcom says it has already reset those 196 passwords to block any takeover.
A much smaller group was hit harder. For 43 accounts, the intruder also saw date of birth, gender, country or region, and nickname. Credit card information, Capcom stresses, was not part of the compromised data, and the company's games and online services remain fully available.
Reported to police, phishing warning issued
Capcom's timeline runs fast: it detected suspicious activity and began blocking the access on Monday, October 19, set up an incident response headquarters on October 20, and on October 21 reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission. The company says it has "identified and addressed the attack method" but has not disclosed how the attackers got in.
The company is now notifying affected customers and warning them to stay alert. With millions of email addresses exposed, the main practical risk is phishing — fraudulent emails pretending to come from Capcom. "If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files," the company said.
Capcom's second major breach in six years
This is not Capcom's first run-in with attackers. In November 2020, a ransomware attack stole hundreds of thousands of pieces of personal data, including names and addresses of customers and former employees. Six years later, a breach nearly thirty times larger has hit the company's account infrastructure.
Capcom, known for franchises including Resident Evil, Monster Hunter, Street Fighter and Mega Man, employs around 4,000 people. The company says it takes the matter "extremely seriously" and will publish further updates on its official website as the investigation continues.
By Hamza Faisal
