Capcom has confirmed that attackers broke into CAPCOM ID, the shared login used across its web services and some online games, and obtained 11,774,247 email addresses. The Japanese game publisher said the intruders also changed the passwords on 196 accounts, apparently to lock out their owners.
What Capcom Says Attackers Took From CAPCOM ID
Capcom detected suspicious activity on its systems on October 19 and confirmed unauthorized access the same day. By the next day, its investigation showed that customer data had been taken. The company reported the incident to police and to Japan’s Personal Information Protection Commission on October 21 and published a public notice on October 22.
For all of the roughly 11.8 million affected accounts, the exposed data includes the email address, the account creation date, the last login date, the number of times the account has logged in, and the IP address used for the most recent login. Capcom did not describe those fields as sensitive credentials, but together they give an attacker a detailed picture of how active each account has been.
A Smaller Group of 43 Profiles With Personal Details
For 43 accounts, the exposure went further. Capcom said the attackers also obtained the account holder’s date of birth, gender, nickname and country or region. The company did not explain why that profile data was available for only a small number of accounts.
The 196 Accounts Where Passwords Were Changed
In 196 cases, the attackers altered the CAPCOM ID password. Capcom’s account of the incident suggests the goal was to prevent legitimate owners from signing in. The company has since reset those passwords. Capcom stated that no other passwords were exposed and that no credit card data was affected, and it said its online services remain available.
Unanswered Questions About the Intrusion Route
Capcom has not said when the intrusion began, so the period during which the attackers had access is unknown. The company also has not disclosed how the attackers got in. It said only that it identified the entry route and applied countermeasures. That leaves open whether the access came through stolen credentials, an unpatched system or another weakness in the CAPCOM ID infrastructure.
The company, which reports about 4,000 employees and roughly $1.24 billion in annual revenue, said it will notify affected customers in stages and set up region-specific support channels. It has also warned customers to watch for phishing emails that impersonate Capcom, a risk that follows directly from so many verified email addresses being in attacker hands.
How This Incident Compares With Capcom’s 2020 Ransomware Attack
This is not the first major security incident at the company. In November 2020, the Ragnar Locker ransomware group attacked Capcom. The group claimed to have stolen 1 TB of data, and the company later said up to 390,000 people could have been affected. That attack began from an old VPN device. The earlier case involved a ransomware crew pursuing internal files, while the CAPCOM ID incident centers on a customer-facing account service and a far larger number of people.
Why Login Metadata Matters for Phishing
Email addresses paired with last login dates and IP addresses allow targeted lures. A message that references an account’s activity level or approximate location can look more credible than a generic mailing. Capcom’s own warning about impersonation emails reflects that risk. The company has not said whether it has seen any such campaigns yet.
Regulatory Reporting and the Road Ahead
Capcom’s reports to Japanese police and the privacy regulator mean the case is now under formal review. The regulator’s findings, along with any further detail from Capcom about the intrusion window and the method of entry, will determine how serious the exposure ultimately proves to be. The staged notification process means that many of the 11.77 million account holders will learn of the exposure only after the public notice.
The attackers’ decision to change 196 passwords is the detail that separates this breach from a simple data scrape. It indicates hands-on activity inside the account system rather than passive copying, and Capcom has not yet said whether the attackers retained any other access before the countermeasures took effect.
