Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and related information.
In addition to emails, the data exposed includes account creation date, last login timestamp, number of logins, and the IP address used during the last login.
Capcom found that for a small subset of 43 accounts, dates of birth, gender, nicknames and countries were also exposed.
For another subset of 196 accounts, hackers changed CAPCOM ID login passwords in an attempt to lock out owners, but the company took action and reset them.
In an alert released today, the gaming company claims that the passwords of all other registered members were not disclosed and that credit card information was not affected.
Capcom is a Japanese video game developer and publisher known for franchises such as Resident Evil, Monster Hunter, Street Fighter and Mega Man. The company has 4,000 employees and annual revenue of $1.24 billion.
CAPCOM ID is the company’s shared account system used to access its web services and play some of its online games.
Although the timing of the breach remains unclear, Capcom said it detected suspicious activity and confirmed unauthorized access on October 19.
An investigation was immediately launched and the next day it was clear that customer information had been compromised.
On October 21, the company reported the incident to the police and the Japanese Personal Information Protection Commission.
Capcom said its online services are not affected, but warned users to remain vigilant for unsolicited communications and emails requesting additional information, or messages containing URLs and attachments.
During the investigation, Capcom identified the intrusion method and implemented security measures to prevent similar incidents. However, no details related to initial access have been shared.
The gaming company also says it will notify affected customers in stages, likely due to the large number of affected accounts, but it has established region-specific communication channels for submitting support requests.
In November 2020, Capcom suffered an attack claimed by the Ragnar Locker ransomware gang, in which the attackers claimed to have stolen 1TB of data. The company later warned that up to 390,000 people could be affected.
In April 2021, Capcom revealed that the attackers gained access through an old VPN device.
Overall prevention scores can mask what happens after initial access. Once attackers use valid credentials, prevention drops significantly.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Gn tech
