The short version
- Capcom says an outsider accessed data from 11,774,247 Capcom ID accounts worldwide.
- What leaked is mostly email addresses plus login records. For 43 accounts, date of birth, gender, country and nickname were exposed too.
- Capcom says there's no evidence passwords leaked, and no card details were involved. The attacker did change the password on 196 accounts, which Capcom has reset.
- Games that use Capcom ID, like Street Fighter 6 and Monster Hunter Wilds, keep working as normal. The real risk now is phishing email.
What Capcom ID is
Capcom ID is the company's shared online account. Street Fighter 6 needs one for its online features, Capcom uses it for Monster Hunter item campaigns and newsletters, and it ties together Capcom's websites and events. TechRadar says it has more than 10 million users, which lines up with the size of this breach: nearly every account appears to be affected.
Image: Capcom
What happened, day by day
Image: Zerocade
Capcom published its notice on October 22 and laid out the timeline:
- October 19: it spotted suspicious activity on the Capcom ID system, blocked the access and confirmed a break-in the same day.
- October 20: it confirmed customer data had leaked.
- October 21: it reported the breach to the police and to Japan's privacy regulator, the Personal Information Protection Commission.
- October 22: public notice, and the 196 hijacked passwords reset.
Capcom hasn't said how the attacker got in. No group has claimed the attack, and no data samples have turned up publicly, according to TechRadar.
What was taken
Image: Zerocade
The bulk of the 11.7 million records hold an email address and some system details: when the account was made, when it last logged in, how many times it has logged in, and the IP address used for that last login. An IP address can give away a rough location, such as your city or your internet provider, but not your home address.
The 43 accounts with extra details exposed, and the 196 with changed passwords, suggest the attacker could do more than read a database for at least a short time. Capcom says it has contacted those players.
Should you worry?
On paper, this is one of the milder big breaches. Capcom says your own password wasn't readable and no payment data was involved. Unless you're one of the 196, Capcom says you don't need to do anything with your account.
The bigger risk is your inbox. Whoever has these addresses knows they belong to Capcom players, which makes convincing fake "Capcom" emails easy: a ban warning, a free Monster Hunter bonus, an "account verification" link. Capcom's advice is to ignore links and attachments in any suspicious message.
A few sensible steps anyway:
- If you reused your Capcom ID password on other sites, change it there. Reused passwords are how one breach turns into five.
- Turn on two-step login wherever your gaming accounts offer it, especially PSN, Xbox and Steam.
- Don't trust an email just because it knows you play Street Fighter. Go to Capcom's site directly instead of clicking.
- Check your email on a breach-alert service such as Have I Been Pwned once this data is added.
Not Capcom's first breach
In November 2020, the Ragnar Locker ransomware group hit Capcom and took about a terabyte of data. Capcom later said the attackers got in through an old VPN device, and that the personal data of about 390,000 people, including customers, business partners and former staff, was affected. That attack also leaked internal plans for unannounced games.
For more on how attacks hit game services, see our explainer on DDoS attacks. Capcom says it will contact affected users directly. Players in Asia outside Japan can reach it at info-asia@capcom.com.
