Tech brief

Capcom Says Nearly 11.8 Million CAPCOM ID Accounts Were Exposed in a Breach: What Gamers Should Do

By , Tech Cheat Codes Team

Published 3 min read

Illustration: a generic game controller on a couch cushion under a broken-open padlock, with envelopes flying out.
On this page · 3 sections
  1. The details
  2. What to do now
  3. Sources

If you or your kids play Capcom games online, check your inbox carefully this week. The real danger now is a fake "Capcom" email.

What happened: Capcom, the Japanese game company, says a third party broke into CAPCOM ID, its online account system. Email addresses and basic account records (such as when you last logged in and from which IP address) for 11,774,247 accounts worldwide were exposed.

What this means for you: Capcom says no credit card information was taken, and you can keep playing as normal. The bigger risk is scam emails, texts or calls pretending to be Capcom, since scammers may now know your email address.

The details

What was taken

CAPCOM ID is the account you use for some Capcom websites. You also need it to play certain Capcom games online. Here's what Capcom says was exposed, as of October 22:

What was exposed How many records
Email address, plus account creation date, last login date and time, number of logins, and the internet (IP) address used at last login 11,774,247
Date of birth, gender, country or region, and nickname 43 of those
Password changed by the attacker 196 of those

Capcom says it has found no sign that passwords customers set themselves were stolen. For the 196 accounts the attacker changed, Capcom says it has already reset the passwords.

A small update on October 23

A day later, Capcom shared more findings. The attacker also got into the e-Capcom store accounts tied to 19 of those 196 accounts. e-Capcom is Capcom's online shop in Japan. For those 19 Japanese customers, the details exposed included names, phone numbers, home addresses, birth dates and purchase history. Again, Capcom says no card information was included.

Capcom says its investigation into the scope is now complete. It found no other accounts with data taken through the password changes.

The timeline

  • October 19: Capcom spotted suspicious activity, started blocking it, and confirmed the break-in the same day.
  • October 20: It set up an incident response team and confirmed customer data was involved.
  • October 21: It reported the incident to the Osaka police and Japan's privacy regulator.
  • October 22–23: Capcom announced the breach and the follow-up.

Capcom says it will contact affected customers.

Illustration: a fake email titled "Your account will be banned!" pokes out of an open envelope, caught on a fishing hook, between a game controller and a caution sign. It's stamped "MADE-UP EXAMPLE."

What to do now

  • Be suspicious of "Capcom" messages. Capcom warns that the stolen details could be used to send fake emails, texts or calls pretending to be Capcom or related companies. Don't click links or open attachments in them.
  • Go to Capcom directly. If a message says there's a problem with your account, close it. Then type Capcom's website address yourself instead of using the link.
  • Change reused passwords. Capcom says it hasn't found stolen passwords. But if your CAPCOM ID password matches one you use elsewhere, especially your email, change those other accounts to a new, unique password.
  • Talk to your kids. Tell them that a message offering free in-game items or warning that their account will be "banned" is a classic scam. They should show you before clicking anything.
  • Questions? In the Americas and Europe, Capcom says to use its customer support form.

Sources