Capcom confirms CAPCOM ID breach with over 11 million records
Emails, login data and IP addresses were exposed. Capcom says there is no evidence passwords leaked, but 196 accounts had their passwords changed without permission.
Capcom has confirmed a data breach involving CAPCOM ID, the account system used for online features in games such as Street Fighter 6. The company detected and confirmed the problem on October 19 and made it public on October 22.
What was exposed
According to Capcom, 11,774,247 records were affected. The data includes:
- Email address;
- Account creation date;
- Date of last login and number of logins;
- Last IP address used.
In 43 records, the exposed data also included date of birth, gender, country and nickname.
What about passwords?
Capcom says it found no evidence that customer passwords leaked and that payment card information was not affected. Even so, 196 accounts had their passwords changed without authorization. The company reset the passwords of those accounts.
How to protect yourself
The biggest risk now is phishing. With millions of real email addresses in the wrong hands, fake messages pretending to come from Capcom are likely. The company advises players not to open links or attachments in suspicious emails. Some simple steps help:
- Change your CAPCOM ID password, especially if you use the same password elsewhere.
- Be careful with emails that ask for login details or offer rewards.
- Access your account by typing the official address, not by clicking links.
Capcom reported the incident to the Osaka police and to Japan's Personal Information Protection Commission.
Not the first time
This is not Capcom's first security problem. In November 2020, a ransomware attack exposed information from about 350,000 people, including employees, partners and customers. The new case is far larger in number of records, even though the type of data involved is less sensitive.
