Capcom says data breach exposed email addresses tied to over 11 million Capcom ID accounts

Capcom has disclosed a data breach in which a third party accessed information linked to 11,774,247 Capcom ID accounts, according to Rock Paper Shotgun, which reported on a Capcom press release. The company says it first noticed suspicious activity on the account service on October 19.

Capcom ID is the account system that players need for online play in games such as Street Fighter 6. Capcom said the attacker accessed email addresses and “system-specific identifier information” for every affected account. For 43 of those accounts, the attacker also reached each user’s date of birth, gender, country or region, and nickname.

According to the statement, Capcom has found no evidence that passwords set by customers were compromised. It did find that passwords on 196 accounts had been changed without permission. Those passwords have since been reset, and Capcom says it is still working out how far the incident reaches. The company plans to notify affected customers. It said credit card information was not among the data involved.

Players can keep using the email addresses registered to their Capcom ID accounts. Capcom warned, however, that the leaked data could be used to send fraudulent messages that pretend to come from Capcom or related parties. The company advised players not to open links or attachments in any suspicious email or message they receive.

Capcom reported the incident to the Osaka Prefectural Police and to Japan’s Personal Information Protection Commission. It said its initial response “identified and addressed the attack method involved in this incident.” A detailed investigation will now look for measures to prevent a similar breach in the future.