Capcom Co. said Thursday that unauthorized access to its CAPCOM ID online membership service exposed email addresses and login metadata for 11,774,247 accounts worldwide, one of the largest disclosed customer-data incidents involving a Japanese game publisher in recent years.
The Street Fighter and Monster Hunter publisher said it detected suspicious activity on 19 October, blocked the intrusion the same day and found that attackers had changed passwords on 196 accounts without permission. Capcom reset those logins and said it had not confirmed that customers' original passwords were stolen. Payment card data was not among the affected fields, according to the company's English-language notice.
What was exposed
Capcom ID is the unified account players use for online features across Capcom titles and web services. The company said the compromised records included email addresses paired with system identifiers such as account creation time, last login time, login counts and the IP address used during the most recent session.
An additional 43 records within the larger set also included birth dates, gender, country or region and nicknames, Capcom said. The publisher established an internal incident headquarters on 20 October, reported the case to Osaka police and Japan's Personal Information Protection Commission on 21 October, and warned users to watch for phishing messages impersonating Capcom.
Online play and CAPCOM ID-linked services remained available after emergency measures, the company said, adding that players' ability to access games was not interrupted.
Response in Tokyo
The disclosure landed as Japanese ministries and companies were already taking websites offline or applying emergency patches following the global PHP vulnerability disclosures that disrupted public-sector pages this week. Capcom's notice did not attribute the CAPCOM ID intrusion to that flaw, and the company said it had identified and addressed the attack method used against its service.
Industry analysts noted that Capcom previously suffered a high-profile ransomware incident in 2020 that exposed internal files and some customer data, making Thursday's statement closely watched by investors. Shares in the Osaka-based firm trade on the Tokyo Stock Exchange Prime market.
Capcom President Haruhiro Tsujimoto signed the apology release posted to the investor relations site, promising notifications to affected customers and continued investigation.
What players should do
Capcom advised users who receive unexpected messages claiming to be from the company not to open attachments or follow links. Because email addresses and last-login metadata can help attackers craft convincing phishing lures, security researchers outside the firm recommended enabling two-factor authentication where available and rotating passwords on accounts that reused CAPCOM ID credentials elsewhere.
The publisher said it would publish further findings as its probe continues. No law-enforcement agency had publicly named suspects as of Thursday afternoon in Japan, and Capcom did not estimate when its forensic review would conclude.