Capcom Confirms CAPCOM ID Breach Exposing 11.7M Customer Records

Capcom has disclosed a security breach affecting its CAPCOM ID account system, warning that attackers accessed customer information linked to its online services and games. The company detected suspicious activity on October 19 and confirmed the intrusion the same day.

CAPCOM ID is used to sign in to Capcom’s web services and to play certain titles online. According to the company, attackers obtained 11,774,247 records containing email addresses and system data such as account creation dates, last login times, login counts, and the IP address used for the most recent sign‑in. For 43 accounts, additional personal details—including date of birth, gender, country or region, and nickname—were exposed.

Capcom said it found no evidence that customer‑set passwords were compromised, but attackers changed the passwords on 196 accounts without authorization. Those passwords have been reset. Payment card information was not affected. The company warned that stolen email addresses could be used to send fraudulent messages impersonating Capcom or related parties and urged users not to click links or open attachments in suspicious emails.

After detecting the breach, Capcom blocked the unauthorized access route and began investigating the attack method. On October 20 it established an internal incident response headquarters and notified Japan’s Information Technology Security Oversight Committee. The following day, it reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission. Capcom says it has completed its emergency response and addressed the attack method, and that CAPCOM ID services and its games remain available.

The company plans to notify affected customers and has opened regional support channels, including a toll‑free line in Japan and online inquiry forms for players in the Americas, Europe, the Middle East, and Africa. Capcom said it will publish updates if new information emerges. No group has claimed responsibility for the attack.

This marks Capcom’s second major cyber incident in recent years. In November 2020, the company suffered a ransomware attack that compromised personal information belonging to up to 350,000 customers, employees, and business partners. Other gaming companies have also faced attacks this year, including Rockstar Games, which confirmed a breach in April.