Japanese game publisher Capcom has disclosed unauthorized access to its CAPCOM ID platform affecting 11,774,247 records around the world. The exposed information primarily consists of email addresses and account-activity metadata, while attackers also changed passwords on 196 accounts without permission.

Capcom detected suspicious behavior on October 19 and began blocking access as it investigated. By the following day, the company had established an internal incident-response headquarters and confirmed that customer information was involved. It reported the matter to Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21, then announced plans to notify affected customers.

What the exposed records contained

CAPCOM ID is the publisher’s shared identity service across its websites and is required for online access to certain games. According to the disclosure, the affected data included registered email addresses, account creation timestamps, last-login timestamps, login counts and the IP address used for the most recent login.

A subset of 43 records also contained dates of birth, gender, country or region, and nicknames. Those entries are included within the overall 11.7 million figure rather than representing an additional group. Capcom emphasized that payment-card information was not exposed.

The number refers to records, and the available notice does not establish that each record maps to a unique person. Even so, the scope is substantial. Login history and location-related IP information can give criminals useful context for targeted messages, while an email address connects that context to a reachable individual.

Password changes raise account-takeover questions

Capcom has not said that customers’ original password values were stolen. It has, however, confirmed that 196 account passwords were changed without authorization and says it reset them. That detail shows the activity moved beyond merely viewing stored information for at least some accounts.

The company says investigators identified and addressed the attack method, but its public notice does not specify an exploited vulnerability, stolen credential, compromised administrator or other entry point. It also does not explain the mechanism used to change the affected passwords. Those unanswered questions will matter when customers and defenders assess whether further credential changes are warranted.

Games and online services remain available, and registered email addresses can continue to be used. Capcom has provided regional support channels and says it will make further security improvements as the investigation develops.

Phishing is the clearest follow-on risk

The exposed fields could be assembled into credible messages that appear to reference real CAPCOM ID activity. An attacker might mention account creation or login behavior, claim a security problem and direct the recipient to a counterfeit sign-in page. The breach notice warns customers about fraudulent communications, though it does not say that a related phishing campaign has already been observed.

Affected users should treat unexpected password-reset notices, support requests and QR codes with caution. Instead of following an embedded link, they should navigate directly to an official Capcom property and review the account there. Reusing a CAPCOM ID password elsewhere would increase the consequences of any credential exposure, so unique passwords and a password manager remain sensible precautions.

Practical steps for customers and defenders

• Verify account alerts through Capcom’s official website rather than message links.
• Choose a unique password and change reused credentials on other services.
• Watch for unexpected password-reset emails and unfamiliar account activity.
• Be skeptical of messages that use personal account details to create urgency.
• For corporate mail systems, tune phishing controls for Capcom-themed lures.

The disclosure provides important boundaries: no payment-card data was involved, and a password change is not the same as confirmation that original passwords were extracted. Nevertheless, the combination of millions of contact records and demonstrated changes to a smaller group of accounts warrants attention. Customers should rely on official updates as Capcom’s investigation fills in the missing technical details.