Capcom has confirmed a major security breach of Capcom ID, the free account service required for online play in games like Street Fighter 6 and Monster Hunter — and the numbers are staggering: information linked to 11,774,247 accounts was accessed by someone outside the company.
“Capcom has determined that certain customer information associated with Capcom ID, an online membership account service operated by the company, was subject to unauthorized access by a third party,” the company said in its statement.
What Was Taken — and What Wasn’t
Every one of the 11.7 million affected accounts had its email address exposed, alongside account details that sound innocent individually but paint a clear picture together: when the account was created, when you last logged in, how many times you’ve logged in overall, and the IP address used for that most recent login.
For a much smaller group the damage is worse: 43 accounts had dates of birth, gender, country or region, and nicknames exposed. And 196 accounts had their passwords changed without authorization — in other words, the attacker actively tried to take those accounts over. Capcom has reset those passwords and says it will contact the players affected.
The genuinely good news: Capcom has found no evidence that passwords customers set themselves were leaked, and credit card information was not part of the compromised data.
What Capcom ID Actually Is
Capcom ID is the umbrella service for the online and live-service elements of Capcom’s releases — if you’ve ever played a Monster Hunter or Street Fighter game online, or used the Resident Evil series’ web portals, you very likely have an account, even if you don’t remember making one. As GamesRadar puts it: “If you’ve played a Capcom game this decade, at the very least, I’d have a look at the information you may have provided here.”
The Timeline — and What To Do Now
Capcom first noticed signs of unauthorized access on October 19 and immediately began blocking the activity, set up an internal task force the following day, and by October 21 had reported the breach to police and to Japan’s Personal Information Protection Commission. The company says it “has completed emergency response measures and has identified and addressed the attack method involved,” that services using Capcom ID remain available, and that it is contacting affected customers through dedicated support channels.
Two practical steps: change your Capcom ID password as a precaution, and brace for phishing. With millions of email addresses now in someone else’s hands, scam messages pretending to be Capcom are all but guaranteed — Capcom itself warns players not to click links or open attachments in suspicious emails. If you get a “your account has been compromised, click here” message, skip the link and go to Capcom’s official site directly.
It’s not the publisher’s first breach, either: a November 2020 ransomware attack saw hundreds of thousands of pieces of personal data — including customer and former-employee names and addresses — stolen from Capcom’s servers.