Capcom data breach: 11.7 million CAPCOM ID records exposed, and scam emails are the next risk

If you have ever signed in to play a Capcom game online, there is a fair chance your email address is in this story. Capcom, the Japanese company behind Resident Evil, Street Fighter and Monster Hunter, has confirmed that an outsider got into CAPCOM ID, its player account service. The intruder accessed 11,774,247 records from around the world.

The Capcom data breach is not the worst kind. No card details were taken, and Capcom found no sign that players’ own passwords leaked. But an email address tied to a known gaming account is exactly what scammers need for a convincing fake message. That is the risk worth understanding now.

What sat inside the 11.7 million CAPCOM ID records

CAPCOM ID is one account that works across Capcom’s websites, and it is needed to play some Capcom games online. In its notice of 22 October, Capcom says the affected records held each person’s email address plus account details. Those are the sign-up date, the last login time, the number of logins and the IP address used at the last login. An IP address is a number that roughly shows where a device connected from.

For 43 of those records, the date of birth, gender, country or region and nickname were also exposed. For 196 accounts, the attacker went further and changed the password. Capcom says those passwords have now been reset. Credit card information was not involved.

The timeline is short. Capcom spotted suspicious activity on 19 October, started blocking it and confirmed the break-in the same day. On 20 October it set up an internal response team and informed its outside security advisory committee. On 21 October it reported the case to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission, the national privacy regulator.

The question Capcom has not answered yet

Capcom says it has “identified and addressed” how the attacker got in, but it has not said what that method was. That matters. Taking over 196 accounts is different from simply copying a list of emails, and it raises the question of how the attacker could change passwords at all. Capcom says its investigation continues and it will post updates on its website.

No group has claimed the attack so far, according to Help Net Security. This is also not Capcom’s first incident: in 2020, a ransomware attack exposed personal data of some customers, business partners and staff.

It also follows this month’s Japan data breach wave that hit Yamato Transport, Nikkei and Burger King Japan, whose app breach was a similar size.

If you have a CAPCOM ID, here is what to do

Capcom says your games and account keep working, and you can keep using the same email address. It will contact affected customers directly and has set up support channels by region, listed in its notice.

The main thing Capcom asks is simple: be careful with any email or message that claims to come from Capcom. Don’t tap the links or open the attachments. As general good practice, not advice from Capcom:

• Sign in by typing Capcom’s address yourself, never from a link in an email.
• If you used your CAPCOM ID password on any other site, change it there. Capcom found no sign it leaked, but reused passwords are how one breach becomes two.
• Be wary of messages that know your sign-up date or last login. Those details can make a fake email feel real.
• Treat any email saying your Capcom account was hacked, and asking you to “verify” it through a link, as a likely scam.

We saw the same pattern this week with the Quest Diagnostics data breach. The scam messages that borrow a breach’s name are often a bigger daily risk than the breach itself.

The Capcom data breach response: fast and specific, but one answer short

To be fair to Capcom, its response so far is a good example. It disclosed within three days and gave exact numbers instead of “some users”. It split out the 43 and the 196 cases, named the authorities it told and said plainly what was not taken. In our reading, that is quicker and clearer than many breach notices.

The harder part is trust over time. Players will want to know how the attacker got in and whether the 196 hijacked accounts point to a wider weakness. On balance, in our reading, Capcom has handled the first week well; the real test is whether it explains the cause as clearly as it counted the records.

Watch for Capcom’s emails to affected players, and for any update on its website about the attack method. Until then, treat any message with Capcom’s name on it the way you would a stranger at the door: politely, and without letting it in.