- Capcom discloses breach affecting 11.7 million CAPCOM ID users, primarily exposing email addresses
- A small number of accounts also lost personal details, and attackers reset passwords on 196 accounts
- Company secured the platform, notified authorities, and warned users about phishing attempts
Japanese gaming behemoth Capcom just confirmed suffering a data breach that exposed sensitive information on more than 11.7 million people. Almost all had their emails compromised, with a small subset also losing birthdays and locations, as well as passwords changed.
Capcom is a super popular video game developer and publisher, behind mainstream names such as Resident Evil and Street Fighter. One of its services is called CAPCOM ID - it offers a free, unified account that lets users access various games and online services.
Currently, CAPCOM ID has more than 10 million users and the company recently published a new security advisory on its Japanese site, saying the service was accessed by a third party, “resulting in the leakage of some customer information to external parties”..
Changing passwords
“We deeply apologize for the great inconvenience and concern caused to our customers and all stakeholders,” the machine-translated warning reads.
Capcom said the breach triggered its security protocols, and that the CAPCOM ID service has been secured. It continues to be available for use, and there is no impact on gameplay in any of the games.
However, the analysis of the breach determined that the threat actors obtained 11,774,247 user email addresses, as well as system-specific identification information: account creation date and time, last login date and time, number of login counts, and client IP at last login
For a handful of users - 43 of them - the threat actors also obtained dates of birth, gender information, nicknames, and data on their country and region. For 196 people, the attackers managed to change their passwords, in an attempt to lock legitimate users out of their accounts. The passwords themselves weren’t leaked, and Capcom said it triggered the password reset process and that the accounts were restored to their rightful owners.
“We will contact eligible customers individually in order. Please note that credit card information is not included in the leak target,” the company concluded.
Capcom did not discuss the identity of the attackers, or the nature of the breach. Therefore, we don’t know if the attackers stole an employee’s login credentials via phishing, or broke in using a vulnerability such as the php2shell flaw that everyone is scrambling to patch right now. We also don’t know if the attackers tried to make contact or attempted to extort Capcom for money, in exchange for deleting the data.
No threat actors have yet claimed responsibility for the attack on the dark web and have not shared samples or leaked the full database. Capcom said it notified the police and other relevant authorities, and that the investigation continues.
Targeted again
Capcom has had cybersecurity incidents in the past. In November 2020, the company fell prey to the infamous Ragnar Locker ransomware group, which managed to walk away with a terabyte of sensitive data. A few months later, the company said the attackers broke in through an old VPN device, and confirmed the breach affected 390,000 people.
Capcom also builds and runs gaming machines and has, as of March 2026, employed almost 4,000 people worldwide. In fiscal 2025 its games sold 51.87 million units, and two titles - Resident Evil and Street Fighter - are currently making great strides in movie theaters around the world. For fiscal 2026, the company’s annual revenue reached $1.3 billion.
Just having someone’s email address is not enough for a serious cyberattack, but it is a good start towards a highly tailored phishing email which can result in ransomware infections, infostealers, or business email compromise (BEC). Capcom is now urging users to be vigilant and wary of incoming email messages, especially those containing references to the company.
Via BleepingComputer