CAPCOM has disclosed a data breach affecting its CAPCOM ID service, with attackers gaining unauthorised access on 19 October and exfiltrating information by 22 October. The company states that 11,774,247 email addresses were stolen, alongside account details such as creation dates, last login dates, login counts and the IP addresses used for the latest logins. In 43 instances, additional data including date of birth, gender, country/region and nickname were exposed. Capcom confirmed that passwords in 196 accounts were modified by the attackers, and those accounts have since been reset.
Capcom has activated its incident response procedures, with services using CAPCOM ID described as still operational. The firm has notified authorities, begun contacting affected customers via a dedicated support channel, and warned users to be vigilant for phishing emails that impersonate Capcom or its partners, especially those containing suspicious links or attachments.
The company says it is investigating the breach, identifying the attack method, and will address the root causes while strengthening security measures to prevent recurrence. Capcom notes it has previously been targeted by Ragnar Locker in November 2020, which claimed to have stolen data affecting hundreds of thousands of individuals. The investigation is ongoing, and Capcom has established a task force to gather information and coordinate response efforts.