Capcom data breach confirmed — around 11.7 million accounts thought to have been affected

(Image credit: Getty Images) Capcom discloses breach affecting 11.7 million CAPCOM ID users, primarily exposing email addressesA small number of accounts also lost personal details, and attackers reset passwords on 196 accountsCompany secured the platform, notified authorities, and warned users about phishing attemptsJapanese gaming behemoth Capcom just confirmed suffering a data breach that exposed sensitive information on more than 11.7 million people. Almost all had their emails compromised, with a small subset also losing birthdays and locations, as well as passwords changed.Capcom is a super popular video game developer and publisher, behind mainstream names such as Resident Evil and Street Fighter. One of its services is called CAPCOM ID - it offers a free, unified account that lets users access various games and online services.Currently, CAPCOM ID has more than 10 million users and the company recently published a new security advisory on its Japanese site, saying the service was accessed by a third party, “resulting in the leakage of some customer information to external parties”..Changing passwords“We deeply apologize for the great inconvenience and concern caused to our customers and all stakeholders,” the machine-translated warning reads.Capcom said the breach triggered its security protocols, and that the CAPCOM ID service has been secured. It continues to be available for use, and there is no impact on gameplay in any of the games.However, the analysis of the breach determined that the threat actors obtained 11,774,247 user email addresses, as well as system-specific identification information: account creation date and time, last login date and time, number of login counts, and client IP at last loginFor a handful of users - 43 of them - the threat actors also obtained dates of birth, gender information, nicknames, and data on their country and region. For 196 people, the attackers managed to change their passwords, in an attempt to lock legitimate users out of their accounts. The passwords themselves weren’t leaked, and Capcom said it triggered the password reset process and that the accounts were restored to their rightful owners.Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!“We will contact eligible customers individually in order. Please note that credit card information is not included in the leak target,” the company concluded.Capcom did not discuss the identity of the attackers, or the nature of the breach. Therefore, we don’t know if the attackers stole an employee’s login credentials via phishing, or broke in using a vulnerability such as the php2shell flaw that everyone is scrambling to patch right now. We also don’t know if the attackers tried to make contact or attempted to extort Capcom for money, in exchange for deleting the data.No threat actors have yet claimed responsibility for the attack on the dark web and have not shared samples or leaked the full database. Capcom said it notified the police and other relevant authorities, and that the investigation continues.Targeted againCapcom has had cybersecurity incidents in the past. In November 2020, the company fell prey to the infamous Ragnar Locker ransomware group, which managed to walk away with a terabyte of sensitive data. A few months later, the company said the attackers broke in through an old VPN device, and confirmed the breach affected 390,000 people.Capcom also builds and runs gaming machines and has, as of March 2026, employed almost 4,000 people worldwide. In fiscal 2025 its games sold 51.87 million units, and two titles - Resident Evil and Street Fighter - are currently making great strides in movie theaters around the world. For fiscal 2026, the company’s annual revenue reached $1.3 billion.Just having someone’s email address is not enough for a serious cyberattack, but it is a good start towards a highly tailored phishing email which can result in ransomware infections, infostealers, or business email compromise (BEC). Capcom is now urging users to be vigilant and wary of incoming email messages, especially those containing references to the company.Via BleepingComputer Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.