Capcom confirms cybersecurity breach compromising 11.7 million Capcom ID accounts
The Japanese gaming publisher disclosed unauthorized access to player emails and authentication tokens, urging players to monitor for credential phishing.
Technology news
Japanese video game powerhouse Capcom officially confirmed on Saturday that a massive cybersecurity intrusion compromised the personal records of over 11.7 million registered users on its Capcom ID membership platform. In a formal corporate security disclosure, the publisher revealed that external adversaries gained unauthorized access to its network infrastructure on October 19, prompting an immediate containment response and ongoing forensic investigation with cybersecurity specialists and law enforcement.
The leaked dataset primarily encompasses player email addresses and internal system user identifiers used across Capcom's online gaming catalogue, including Street Fighter 6, Monster Hunter, and Resident Evil titles. In addition, the intruders obtained the birth dates, gender, country or region metadata, and handles for 43 accounts, and successfully executed unauthorized password modifications on 196 user accounts. Capcom emphasized that payment card details and financial transaction records were not stored within the breached Capcom ID database and remained fully insulated.
Capcom stated that it has neutralized the specific intrusion vector used during the incident and confirmed that all online services, multiplayer matchmaking, and Capcom ID authentications remain online. However, the company issued an urgent advisory warning players to remain vigilant against phishing campaigns and social engineering scams that may leverage leaked email addresses to impersonate Capcom support personnel.
Our take: Gaming identity platforms have become prime targets for automated credential stuffing and phishing pipelines. Even without exposed credit cards, 11.7 million validated gaming emails provide cybercriminals with substantial ammunition for targeted spear-phishing and account takeover attacks across the broader PC and console ecosystem.