Capcom confirms CAPCOM ID breach exposing 11.7M accounts

Capcom confirmed on October 22 that an intruder reached CAPCOM ID, the shared account system behind its web services and some online games, and exposed data tied to 11,774,247 accounts. The figure and the detail below come from Capcom's own notice; BleepingComputer reported the same numbers. No passwords customers set themselves and no credit-card data were taken — but 196 accounts were actively hijacked, so this is a hands-on intrusion, not a passive leak.

What was exposed

Per Capcom's notice, for all 11,774,247 records:

• Email address
• Account creation date and time
• Last login date and time
• Login count
• Client IP address used at last login

A further 43 records also included date of birth, gender, country/region and nickname. 196 accounts had their login passwords changed without authorization; Capcom has reset those. Capcom states that "credit card information was not included among the affected information," and has not confirmed that customer-set passwords were compromised.

Timeline

• October 19: Capcom detected suspicious activity, blocked access and confirmed the unauthorized access.
• October 20: It stood up an incident-response headquarters, confirmed the customer-data access and the unauthorized password changes, and notified its external IT Security Oversight Committee.
• October 21: Capcom reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.
• October 22: Public notice issued.

Capcom has not disclosed the initial-access vector or when the intrusion began. It says it has identified the method and added countermeasures. CAPCOM ID and games remain available.

Attribution

No group has claimed responsibility, and Capcom has not attributed the breach. There is no data-leak or extortion claim at publication. The 196 unauthorized password changes mean an operator was working inside the system, not merely exfiltrating a dump.

Action checklist

For CAPCOM ID holders:

1. Rotate your CAPCOM ID password now — and anywhere you reused it. Credential reuse is the obvious next move for whoever holds this data.
2. Turn on any available 2FA for the account.
3. Treat your email address as burned. Capcom warns the exposed addresses enable phishing that impersonates Capcom; do not open links or attachments in unsolicited "Capcom" messages.
4. If you are among the 196, Capcom has reset your password — set a new one you control and review any linked entitlements or purchases.

There is nothing to patch here; for defenders this is a credential-reuse and phishing-awareness item.

Context

Capcom was last breached in November 2020, when the Ragnar Locker ransomware gang hit its internal network — up to 390,000 people were potentially affected, and Capcom later traced entry to an old VPN device. This incident is a different animal: a customer-facing identity system rather than internal file servers, and no ransomware component so far. Publisher account systems hold tens of millions of verified emails tied to spending profiles, which keeps them a standing target; the useful question for operators is how an outsider reached an identity store holding 11.7 million records, and Capcom has not yet answered it.