Capcom Breach Exposes 11.7 Million Email Addresses

Capcom says hackers accessed its CAPCOM ID service and stole more than 11.7 million customer email addresses. Although the company says user passwords were not exposed, the stolen information could help criminals create convincing phishing messages aimed at gamers and their families.

What happened

Capcom discovered unauthorized access to CAPCOM ID on October 19, according to SecurityWeek. CAPCOM ID is the shared account system used to access Capcom online services and play online games.

The attackers obtained 11,774,247 email addresses. They also took account records that included creation dates, recent login dates, login counts and the IP address used for the latest login.

For 43 customers, the exposed information also included dates of birth, gender, country or region, and nicknames. The attackers changed the CAPCOM ID passwords of 196 users, but Capcom says it reset those accounts and found no evidence that customers’ existing passwords were stolen.

Capcom has begun contacting affected customers and established a dedicated contact point for questions. The company reported the incident to authorities and said its investigation remains underway. It has not disclosed how the attackers entered the service or whether any additional protective measures will be required from customers.

Who is affected

Anyone whose email address was connected to a CAPCOM ID may be included. This can cover people who use Capcom online services or play games that require the company’s shared account system.

Most affected users had an email address and account activity details exposed. A much smaller group had additional personal information taken, while 196 accounts had their passwords changed by the attackers. Capcom said services using CAPCOM ID remain available.

What to do now

1. Check your CAPCOM ID directly. Open Capcom’s official website or the game service you normally use instead of following a link in an unexpected email. Confirm that you can sign in and that your account details have not changed.

2. Watch for a notice from Capcom. The company says it is contacting affected customers in stages. Treat messages demanding payment, urgent verification or an immediate download as suspicious.

3. Change the password if you cannot sign in, Capcom tells you to reset it, or you reused it elsewhere. Start from Capcom’s official service, then give the account a long, unique password. If the old password was reused, change it on every other account that shares it.

A password manager makes it easier to create and store a different password for every gaming and household account.

4. Be careful with Capcom-themed email. Capcom specifically warned about impersonation messages containing suspicious links or attachments. Do not open an attachment or enter login information after clicking an unsolicited message.

5. Review the email account tied to CAPCOM ID. Look for unfamiliar sign-ins, password-reset messages or forwarding rules. Secure that mailbox first if anything appears wrong, because access to email can help an attacker reset other accounts.

6. Keep evidence of suspicious activity. Save unexpected Capcom messages and note any unauthorized account changes. Use Capcom’s dedicated contact channel if the company identifies your account as affected.