Capcom ID Breach Affects More Than 11.7 Million Users

Capcom has announced that Capcom ID, its online membership service, was accessed by an unauthorized third party. According to the company's announcement this week, the breach affected more than 11.7 million users, adding another entry to the list of recent data breaches in the gaming industry.

The company stressed that customers' credit card information was not part of the incident. It nonetheless warned that the leaked data could be used in fraudulent emails made to look as though they were sent by Capcom, and asked users to be more careful with their inboxes.

What data was affected?

According to Capcom, millions of account email addresses were exposed in the breach. For 43 accounts, additional details were also involved: date of birth, gender, country or region, and nickname. That means the number of accounts with this extra personal data is very small compared with the total number of affected users.

The company also reported that passwords were changed without authorization on 196 accounts. Capcom specifically noted that customers' credit card details were not part of the breach. That distinction lowers the likelihood of direct financial loss, but the exposure of email addresses still raises other risks, such as phishing.

How was it discovered and what was done?

Capcom said that on October 19 it detected suspicious activity pointing to possible unauthorized access to Capcom ID. The company immediately blocked access and began investigating the cause and scope, though it also confirmed that the unauthorized access had already taken place by that point.

Capcom reported the incident to local police and to an external advisory body it works with on security audits. The company also said it has identified the attack method used in this incident and has taken the necessary countermeasures.

What changes for users?

All services that use Capcom ID remain available. Games that require a Capcom ID for online play, such as Street Fighter 6, continue to work, so players can still log in and use online modes without interruption.

Even so, the company cautioned that the exposed information could be used to send fake emails impersonating Capcom. In phishing, attackers pose as a trusted brand to lure users to a fake page and persuade them to enter passwords or payment details, so users are advised to be wary of suspicious emails and links.

Not an isolated case in the industry

Capcom is not the only major game company to suffer a data breach recently. Rockstar Games also confirmed in April that it had experienced a breach originating from a third party. The string of disclosures has put the security of online account systems at gaming companies back in the spotlight.