Capcom Confirms Data Breach Affecting 11,774,247 Users
- Hackers breached Capcom’s online membership network and accessed personal records belonging to 11,774,247 users worldwide, exposing email addresses, account creation dates, login frequencies, and recent IP addresses.
- The exposed datasets also included dates of birth, genders, nicknames, and countries for a subset of 43 accounts.
- Capcom detected suspicious activity on its network and confirmed the unauthorized intrusion on October 19.
Hackers breached Capcom’s online membership network and accessed personal records belonging to 11,774,247 users worldwide, exposing email addresses, account creation dates, login frequencies, and recent IP addresses. The breach affects the CAPCOM ID system used to access web services and online games across the publisher’s major franchises, including Resident Evil, Street Fighter, Monster Hunter, and Mega Man.
The exposed datasets also included dates of birth, genders, nicknames, and countries for a subset of 43 accounts. Capcom stated that customer passwords were not compromised in the breach, though attackers changed the login passwords on 196 accounts in an attempt to lock out their owners before the company reset them. Payment card information remained unaffected during the intrusion.
Unauthorized Access Detected on October 19
Capcom detected suspicious activity on its network and confirmed the unauthorized intrusion on October 19. The publisher blocked the suspicious access and began investigating how the attackers entered the system, though the exact timing of the initial breach and the specific intrusion method have not been publicly disclosed.
An internal incident response headquarters was established on October 20. On the same day, the company notified the Information Technology Security Oversight Committee, an external advisory body. Capcom then reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21.
Previous Breaches and Ongoing Investigation
The publisher previously suffered a major ransomware attack in November 2020 that compromised up to 350,000 records belonging to customers, business partners, and employees. The company has also faced industry-wide cyber security pressures affecting major game developers, such as an April attack on Rockstar Games claimed by the ShinyHunters group.
Capcom has completed its emergency response phase and reports that its CAPCOM ID services and online games remain available. The company has opened region-specific support channels, including a toll-free telephone line in Japan and online inquiry forms for players in the Americas, Europe, the Middle East, and Africa, while its broader investigation continues.