Capcom Data Breach Hits 11.7 Million CAPCOM ID Accounts: What Was Exposed and What to Do Now

Capcom confirms 11,774,247 CAPCOM ID records were accessed, with email addresses and login data exposed. Passwords and card details appear safe – but expect phishing.

If you have ever made a CAPCOM ID to play online, link a game or sign in to one of Capcom's web services, there's a decent chance your email address is now in someone else's hands. On October 22, Capcom – the publisher behind Resident Evil, Monster Hunter and Street Fighter – confirmed that an unauthorized third party accessed customer information tied to its CAPCOM ID membership service, affecting 11,774,247 records worldwide.

The good news: Capcom says there is no sign that the passwords players set themselves were taken, credit card details were not part of the leak, and every game and service that uses CAPCOM ID is still running normally. The bad news: millions of real, active gamer email addresses are exactly what scammers want.

Here's everything Capcom has confirmed so far, and what you should actually do about it.

What was exposed

According to Capcom's official notice, the breach breaks down into three groups. All of the smaller groups sit inside the big one.

So for nearly everyone affected, the leak is an email address together with a snapshot of how and when that account was used, including the IP address from the most recent sign-in. That's far less sensitive than a password dump, but it's still useful to a scammer: it confirms the address is real, that it belongs to a Capcom customer, and roughly when that person last played.

The 196 accounts whose passwords were changed by the attacker are the most serious cases. Capcom says it has reset those passwords to stop the accounts from being taken over, and that its investigation into the impact on them is ongoing.

What wasn't exposed

Capcom says credit card information was not included in the leaked data. It also says it has not confirmed that any passwords chosen by customers were compromised – the 196 changed passwords were set by the attacker, not stolen. Beyond those 196 accounts, CAPCOM ID works as usual, your registered email address can still be used, and the breach doesn't affect your ability to play any Capcom game.

It's worth stressing that the investigation isn't finished. "Not confirmed" is not the same as "ruled out," and Capcom has said it will post updates on its official website as it learns more.

How it happened – and what we don't know

Capcom's timeline is short and specific:

• October 19: Capcom detected suspicious activity, blocked the access and confirmed the same day that unauthorized access had taken place.
• October 20: It set up an internal incident response headquarters, confirmed that customer data had been accessed and that some passwords had been changed, and reported the matter to an external security oversight committee.
• October 21: It reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
• October 22: The public notice and apology went out.

What Capcom hasn't said is how the attacker got in. The company says it has identified and addressed the attack method but has not described it. As of the latest reporting, no hacking group has claimed responsibility, and security outlets haven't seen the data offered for sale.

What you should do now

Capcom's own advice centers on one thing: phishing. Because the stolen data could be used to send fake emails that pretend to come from Capcom or related companies, it asks players to be careful with suspicious emails and messages and not to open links or attachments in them.

In practice, that means:

1. Treat any "Capcom security alert" email with suspicion. Capcom says it will contact affected customers, so a real notice may arrive – but scammers will copy that exact idea. Don't click a link to "verify" or "restore" your account. Go to Capcom's site yourself instead.
2. Never hand over your password or payment details in response to an email, a DM or a "support" chat you didn't start.
3. Change your password if you reused it elsewhere. Capcom says passwords weren't confirmed stolen, but if your CAPCOM ID password is the same one you use for email, Steam, PlayStation or Xbox, now is a good moment to give each account its own.
4. Watch for fake giveaways and "free skin" offers aimed at Resident Evil, Monster Hunter or Street Fighter players. Scammers like to tailor bait to what they know you play.
5. If you can't sign in, you may be one of the 196 reset accounts. Use Capcom's official support channels rather than any link you've been sent.

Capcom has opened dedicated support channels for the incident. Players in the Americas and in Europe, the Middle East and Africa can use the inquiry form on Capcom's official customer support site, EMEA players can also email Capcom Europe, and there's a separate email address for Asia (outside Japan) and Oceania. Japan has a toll-free support line. All of them are listed at the bottom of Capcom's official notice.

Not Capcom's first breach

This is the second major security incident at Capcom in six years. In November 2020, the company was hit by a ransomware attack that exposed personal data belonging to customers, business partners and employees, with the number of affected people eventually put at around 390,000.

This time the data is far less sensitive, but the scale is roughly 30 times larger. CAPCOM ID is a free, unified account used across Capcom's web services and required for some online features in certain games, which is why so many players have one.

Why it matters

For most players, this breach won't mean a hijacked account or a drained bank card. The more likely risk is convincing-looking scam emails. The attacker now knows millions of addresses belong to people who play Capcom games, and that's a strong starting point for a scam.

Capcom says it plans to roll out further security measures once the investigation wraps up. Until then, the safest assumption is simple: if an email about your Capcom account asks you to click something, don't – go to the source yourself.

This article was written by AI (Claude) and checked against the sources above. Games are updated regularly, so details may change.