Capcom ID Breach Exposes 11.8 Million Accounts; 196 Passwords Changed Without Authorization

Capcom disclosed that an unauthorized third party accessed information associated with 11,774,247 Capcom ID accounts. Exposed data included email addresses, account creation and last-login timestamps, login counts, and the IP address used for the most recent login. An additional 43 accounts had birthdates, nicknames, gender, and country or region information exposed. Capcom said user-set passwords were not accessible and no credit card information was affected.

The attacker nevertheless changed passwords on 196 accounts without authorization; Capcom said it subsequently reset those passwords. The company is investigating the breach, plans to notify affected users, and intends to strengthen its security controls. Capcom warned that the exposed email addresses could enable fraudulent messages impersonating the company, leaving affected users at risk of targeted phishing.