Capcom breach exposes 11.7 million account records worldwide

Capcom has disclosed a breach of its player account service, exposing email addresses and login information in more than 11.7 million records worldwide.

The publisher behind Resident Evil, Monster Hunter and Street Fighter said attackers accessed CAPCOM ID, which players use to sign into its websites and some online games. Alongside email addresses, the exposed information included account creation dates, the time of the latest login, login counts, and the IP address used for the most recent sign-in.

Attackers changed passwords on 196 accounts, which Capcom has since reset. A smaller group of 43 records also contained dates of birth, gender, country or region, and nicknames. Both groups are included in the overall total.

Capcom said it had not confirmed that customers’ original passwords were compromised, and payment-card information was not affected. Games and services remain available.

The company detected suspicious activity on October 19 and began blocking unauthorized access. Investigators confirmed the exposure of customer information the following day, and Capcom reported the incident to Japanese police and the country’s privacy regulator on October 21.

Capcom says it has identified and addressed the method used in the attack and completed emergency security measures. It will contact affected customers as it continues investigating the full impact.

The company warned players to watch for fraudulent messages impersonating Capcom or related businesses. With email addresses among the exposed data, it advised customers not to follow links or open attachments in suspicious communications.