Japanese video game publisher Capcom has confirmed a data breach that exposed information belonging to more than 11.7 million CAPCOM ID accounts following unauthorised access by a third party. The company said an internal analysis determined that attackers obtained 11,774,247 user email addresses alongside system-specific identification records, including account creation dates and times, last login timestamps, total login counts, and client IP addresses recorded at the user's most recent login.

What was exposed, and what was not

Beyond email addresses and technical logs, attackers accessed personal profile details for a smaller subset of accounts. Capcom confirmed that threat actors obtained the birth date, gender, country or region, and nickname associated with 43 accounts. Attackers also managed to change passwords on 196 accounts in an attempt to lock legitimate users out, although Capcom said the passwords themselves were not leaked to the attackers, and it initiated password resets to return those accounts to their rightful owners. Customer credit card information was not included in the breach, according to the company's advisory.

The second report: store accounts used

In a second report on 23 October, Capcom said what the attackers did with the accounts whose passwords they changed. With 19 of them, all in Japan, they logged in to My Page on e-Capcom, its online store, which uses CAPCOM ID. There they could see name, phone number, postal code and address, gender and date of birth, purchase history, inquiry history and the member's address book, which can hold other people's delivery addresses. Capcom said no card data was involved, that no information leaked through the other hijacked accounts, and that it will contact the 19 customers.

Why it matters: unified identity platforms have become critical infrastructure across gaming, connecting accounts across consoles, PC storefronts and online multiplayer services. When a central account database leaks, millions of verified email addresses become readily available for credential-stuffing and targeted phishing, even when core financial data remains untouched. If you get a suspicious Capcom email, do not click links: visit the official site by typing the address directly.