Capcom confirmed unauthorized access to its CAPCOM ID platform exposed data from more than 11.7 million customer accounts, including email addresses, login metadata, and for a small subset, additional personal details.
Japanese video game publisher Capcom has confirmed that hackers breached its CAPCOM ID membership platform, exposing the personal data of more than 11.7 million customers, the company said in an alert published Thursday.
The compromised data includes customer email addresses, account creation dates, last login timestamps, login counts, and IP addresses used at last login, according to Capcom.
For a smaller subset of 43 accounts, additional details were exposed, including dates of birth, gender, nicknames, and countries of residence. In a separate subset of 196 accounts, attackers attempted to lock users out by changing CAPCOM ID login passwords — a move the company said it countered by resetting those credentials.
Capcom said passwords for all other registered members were not exposed, and that credit card information remained unaffected throughout the incident.
CAPCOM ID is the company's centralized account system, used to access its web services and certain online games. Capcom, first reported by BleepingComputer, detected suspicious activity and confirmed unauthorized access on October 19. By the following day, investigators had established that customer information had been compromised.
On October 21, Capcom reported the incident to local police and to Japan's Personal Information Protection Commission.
Despite the scale of the breach, Capcom said its online services remain operational. The company urged users to remain alert for unsolicited communications, phishing emails, and messages containing unfamiliar URLs or attachments.
Capcom said it has identified the method of intrusion and has implemented security measures to prevent similar incidents, though it did not disclose how attackers initially gained access.
The company added that affected customers will be notified in stages, citing the volume of impacted accounts, and said it has established region-specific channels to handle support inquiries.
Capcom is known for major gaming franchises including Resident Evil, Monster Hunter, Street Fighter, and Mega Man. The company employs approximately 4,000 people and reported annual revenue of $1.24 billion.
This is not the first significant security incident the company has faced. In November 2020, the Ragnar Locker ransomware group claimed responsibility for an attack in which it said it had stolen 1 terabyte of data. Capcom later warned that up to 390,000 individuals could have been affected by that breach. In April 2021, the company disclosed that attackers in that earlier incident had gained access through an outdated VPN device.
The recurrence of a major breach underscores ongoing vulnerabilities in gaming industry infrastructure, reinforcing concerns that legacy access points and large account databases remain high-value targets for threat actors.
Jay Goldberg is a staff writer at TechEchelon covering technology, markets, and policy. He files the breaking news and deal coverage that move the publication's core desks.
More from Jay →The PHP security team released emergency patches for two critical unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting all PHP installations that serve web requests, with early exploitation already observed in the wild.
A Nigerian national was sentenced to eight years in prison for spearphishing attacks on U.S. tax preparation businesses between 2019 and 2021, stealing more than $3 million through fraudulent tax refunds and SBA loan applications.
A proxyjacking campaign has silently hijacked at least 143 D-Link, Ubiquiti, and other edge devices across 34 countries, enrolling victims' internet connections into a commercial residential proxy network to generate unauthorized payouts, according to GreyNoise.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.