Capcom ID breach exposes 11.7 million player emails and last-login IPs

Capcom has confirmed that an intruder pulled customer records out of Capcom ID, the account players use to sign in to the company’s web services and to play some of its games online. The haul covers more than eleven million email addresses, and each one comes with the date the account was created, the time of its last login, how many times it has logged in and the IP address used for that last sign-in. That combination is what makes the leak useful to criminals: a scammer who knows your address, knows you play Capcom games and roughly knows where you last connected from can write a very convincing fake support email.

For anyone who made an account to play the latest Street Fighter online or to use a Capcom site, the practical risk is a wave of phishing, not an emptied bank account. The publisher behind Resident Evil, Monster Hunter and Mega Man says no credit card information was among the affected data, and it has not confirmed any leak of the passwords customers chose themselves. Its advice is blunt: if a message claiming to come from Capcom or a related company arrives, do not open its links or attachments.

The exact figure in Capcom’s notice is 11,774,247 records worldwide. A much smaller group was hit harder. For 43 accounts, the exposed data also includes date of birth, gender, country or region and nickname. On 196 accounts, the attackers changed the login password without authorization, which BleepingComputer read as an attempt to lock the owners out. Capcom says it has reset those passwords and that every service tied to Capcom ID, games included, is still running.

The notice leaves the biggest questions open. Capcom says it has identified and dealt with the attack method, but it does not describe it, and it has not said how long the intruder had access before the activity was spotted. The password changes also sit awkwardly beside the reassurance about passwords: whoever reset those 196 logins had some route into account controls, even without seeing the original passwords. No group has claimed the attack, according to Help Net Security, and Capcom says its investigation into the full scope is still running.

Players do not need to abandon their email address, since Capcom says registered addresses can keep being used. The useful steps are the familiar ones, and this leak makes them more urgent. Change the Capcom ID password if you reuse it anywhere else. Treat any message that mentions your account history, a recent login or a security problem with your profile as suspect, because that context is exactly what leaked. Go to Capcom’s support pages directly instead of following a link in an email.

Capcom says it detected the suspicious activity on October 19 and blocked it the same day, set up an internal incident response headquarters on October 20, and reported the breach to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21, before publishing its apology on October 22. The company will contact affected customers, in stages according to BleepingComputer, and has opened dedicated support channels: a toll-free line in Japan, online inquiry forms for the Americas and for Europe, the Middle East and Africa, and an email address for Asia and Oceania.

The scale is new for Capcom. Its last major incident, a Ragnar Locker ransomware attack in November 2020, hit the company’s own network and could have affected up to 390,000 people, according to Capcom, which later traced the entry point to an old VPN device. That time the target was the company’s internal systems. This time it was the account millions of players use to log in.

Tags: Cybersecurity, Kali Reis, Cody Rhodes, data breach, David Dastmalchian, Street Fighter, video games, Callina Liang, Capcom, phishing