Capcom suffers major security incident exposing more than 11 million user email addresses

Japanese video game publisher Capcom confirmed that unauthorized intruders accessed its CAPCOM ID membership platform, exposing 11,774,247 user email addresses. The company detected suspicious activity on October 19 and quickly confirmed that customer data had leaked, subsequently alerting law enforcement and Japan's Personal Information Protection Commission on October 21. [1][3]

The compromised data includes account creation timestamps, last login dates, total login counts, and the IP addresses recorded during recent logins. In a subset of 43 accounts, attackers obtained birthdays, genders, nicknames, and regional details. The perpetrators also modified passwords on 196 accounts in an effort to lock out legitimate players, though Capcom restored access and stressed that credit card details were not exposed. [1][2][3]

Capcom says gameplay and core online services remain operational, though it is urging users to watch out for targeted phishing attempts. The intrusion marks the publisher's largest security incident since November 2020, when a ransomware attack by the Ragnar Locker group compromised around 390,000 records. [1][3]