CAPCOM has confirmed unauthorised access to its CAPCOM ID membership system, exposing 11.77 million user records globally. The data primarily comprises account activity details linked to Capcom’s online services and some games, including account creation time, most recent login time, number of logins, and the IP address used for the last login. A small subset of records (43 in total) also included birthdays, gender, country or region, and nicknames. There is no indication that payment card data was exposed.
In terms of credentials, the attacker altered the login passwords for 196 accounts; Capcom has already reset those passwords. It remains unconfirmed whether any password hashes or other authentication data from users’ accounts were leaked. Capcom advises concerned users to reset their passwords and remain vigilant for impersonation attempts, as scammers may pose as Capcom and direct users to phishing sites or request credentials.
The company reported the incident to law enforcement and to Japan’s Personal Information Protection Commission, with notification to affected users to occur by email in batches. Capcom’s CAPCOM ID services and related games continue to operate normally during the investigation. Do note that the guidance focuses on resetting passwords if in doubt and watching for suspicious communications.