Capcom Warns 11.7 Million Players After Capcom ID Data Breach

Did you get an email about your Capcom ID recently? You might want to look twice before clicking.

Capcom has disclosed a data breach affecting over 11 million customer accounts tied to its Capcom ID service — the login system used across its games and online services. The Resident Evil, Monster Hunter, and Street Fighter developer says a third party accessed customer information on October 19, and it's now warning customers to be on guard for potential phishing attempts.

So what actually leaked? Globally, 11.7 million email address records were affected. The exposed data includes when each account was created, when it was last logged into, how many logins it has, and the client IP address used during that last login. A much smaller set — 43 records — included date of birth, gender, country or region, and nickname. On top of that, 196 accounts had their Capcom ID login passwords changed without authorization. Capcom says those passwords have already been reset and that it "continues to investigate the scope of any impact resulting from this incident."

Here's the reassuring part: Capcom insists passwords that customers created themselves were not leaked, and credit card information wasn't among the affected data. It also doesn't expect its video games to be affected. Still, the company isn't downplaying the breach — it reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.

For players, the practical takeaway is simple. Capcom says you can keep using the email address registered with your Capcom ID, but warns the affected info could be misused to send fraudulent emails. "If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files," the company advised. In other words: if something lands in your inbox claiming to be from Capcom and asks you to click a link or open an attachment, slow down and verify it first.

Capcom didn't go into detail on how it was hacked, but said it has completed emergency response measures and has "identified and addressed the attack method involved in this incident." The company added that it takes the matter "extremely seriously" and will keep investigating, implement measures to prevent recurrence, and strengthen its information security framework. It also said it will promptly share updates through its official website if any additional facts requiring disclosure come up — and offered "sincere apologies" to customers and stakeholders.

Data breaches are never fun, but knowing what was and wasn't exposed can help you decide how cautious to be. Have you gotten any suspicious emails tied to your Capcom ID? Will you be keeping a closer eye on your inbox?