Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information.
Apart from emails, exposed data includes account creation date, last login timestamp, number of logins, and the IP address used at the last login.
Capcom found that for a small subset of 43 accounts, dates of birth, gender, nicknames, and countries were also exposed.
For another subset of 196 accounts, the hackers changed the CAPCOM ID login passwords in an attempt to lock the owners out, but the company took action and reset them.
In an alert today, the gaming company says that passwords for all other registered members have not been exposed and that credit card information remained unaffected.
Capcom is a Japanese video game developer and publisher known for franchises such as Resident Evil, Monster Hunter, Street Fighter, and Mega Man. The company has 4,000 employees and an annual revenue of $1.24 billion.
CAPCOM ID is the company’s shared account system used for accessing its web services and playing some of its online games.
Although the timing of the breach remains unclear, Capcom said it detected suspicious activity and confirmed unauthorized access on October 19.
An investigation was launched immediately, and by the following day, it was clear that customer information had been compromised.
October 21, the company reported the incident to the police and to Japan’s Personal Information Protection Commission.
Capcom said its online services remain unaffected, but cautioned users to stay vigilant for unsolicited communications and emails requesting additional information, or messages containing URLs and attachments.
During the investigation, Capcom identified the intrusion method and implemented security measures to prevent similar incidents. However, no details related to the initial access have been shared.
The gaming firm also says it will notify affected customers in stages, likely due to the large volume of affected accounts, but it has established region-specific communication channels to submit support requests.
In November 2020, Capcom suffered an attack claimed by the Ragnar Locker ransomware gang, in which attackers claimed to have stolen 1 TB of data. The company subsequently warned that up to 390,000 people could be affected.
In April 2021, Capcom disclosed that the attackers had gained access through an old VPN device.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.