Capcom Confirms Breach Exposing Data From 11.7 Million Accounts
Summary
Capcom confirmed unauthorized access to its CAPCOM ID service, exposing email addresses and associated account data from more than 11.7 million customers. Payment details and most account passwords were unaffected; the access method remains undisclosed.
Key points
- Capcom confirmed unauthorized access to its CAPCOM ID service on October 19 after detecting suspicious activity; the breach timing is unclear.
- More than 11.7 million customers’ email addresses and associated data, including account creation dates, login timestamps, login counts, and last-login IP addresses, were exposed.
- For 43 accounts, exposed information also included dates of birth, gender, nicknames, and countries.
- Attackers changed the login passwords of 196 accounts; Capcom reset them. Passwords for other registered members and credit card information were not exposed.
- Capcom says its online services remain unaffected and that it identified the intrusion method and implemented security measures, but has not disclosed how initial access occurred.
- The company reported the incident to police and Japan’s Personal Information Protection Commission and plans to notify affected customers in stages.
Article Details
- Victim Organization
- Capcom
- Incident Type
- Unauthorized access to the CAPCOM ID membership service, exposing customer information.
- Disclosure Date
- 2026-10-22
- Data Types Exposed
- Email addresses
- Account creation dates
- Last login timestamps
- Number of logins
- IP addresses used at last login
- For 43 accounts: dates of birth, gender, nicknames, and countries
- Affected Records
- More than 11.7 million accounts; 43 accounts also had additional personal details exposed, and passwords were changed for 196 accounts.
- Operational Impact
- Capcom said its online services remained unaffected. It reset passwords for the 196 affected accounts.
- Ransom Or Extortion
- No ransom or extortion was reported for this incident.
- Claim Status
- confirmed