Capcom Discloses CAPCOM ID Data Breach Impacting 11.7 Million Email Addresses

Capcom disclosed on October 22 that an unauthorized third party accessed customer information tied to its CAPCOM ID online membership service, impacting 11,774,247 email addresses alongside account creation timestamps, login counts, last login times, and client IP addresses. The security incident also exposed date of birth, gender, country or region, and nickname details across 43 additional records. While Capcom has not confirmed the compromise of original customer-set login passwords, the company identified 196 accounts where passwords were changed without authorization and subsequently reset them. Capcom first detected suspicious activity on October 19, blocked the unauthorized access, and established an incident response headquarters on October 20 before notifying the Osaka Prefectural Police and Japan's Personal Information Protection Commission on October 21. "Capcom has not confirmed any compromise of CAPCOM ID account login passwords originally set by customers themselves. However, the company has confirmed that passwords were changed without authorisation on 196 accounts." — Capcom Co., Ltd.