Capcom disclosed that unauthorized third-party access to its Capcom ID online membership service exposed 11,774,247 registered email addresses along with account data including creation dates, last login dates, login counts, and the IP addresses used for the most recent logins.

The company detected suspicious activity on October 19, blocked access immediately, and reported the incident to Osaka Prefectural Police, Japan's Personal Information Protection Commission, and its external Security Oversight Committee.

For 43 accounts, the breach also exposed dates of birth, gender, country or region, and nicknames. Attackers changed passwords on 196 accounts without authorization, and Capcom has since reset those passwords.

No customer credit card information was compromised, and Capcom has not confirmed any compromise of user-set login passwords.

According to GosuGamers, a follow-up Capcom announcement revealed that attackers used 19 of the 196 compromised accounts to reach their associated pages on e-Capcom, the company's Japanese online store.

That exposed customers' names, telephone numbers, postal codes, addresses, purchase histories, customer inquiry histories, saved address book entries, dates of birth, gender, and names written in Japanese phonetic characters.

GosuGamers notes these 19 accounts were already counted among the 196 hit by unauthorized password changes, not a separate group of victims. Capcom's investigation found no further information compromised through the password changes in the remaining accounts.

The company stated that the incident does not affect players' ability to access or play its games, that Capcom ID accounts remain accessible, and that users do not need to change their registered email addresses.

Capcom says it identified and addressed the attack method used and has established dedicated support channels, directing customers in Asia and Oceania to info-asia@capcom.com and other regions to its customer support page.

Security Affairs notes this is Capcom's second major incident, following the November 2020 Ragnar Locker ransomware attack that affected up to 390,000 people.

With millions of verified email addresses in hand, scammers can now send convincing emails impersonating Capcom or its partners.

Capcom explicitly warned that the leaked information could be misused in fraudulent texts, phone calls, or other communications impersonating the company, and urged users to be wary of messages containing suspicious links or attachments, requests to open unfamiliar files, or demands for personal information.

Engadget's report emphasizes that Capcom ID remains fully usable — the warning is about scam emails, not service disruption. Users who receive unexpected Capcom-branded messages should navigate to official support channels directly rather than clicking through.

Capcom activated its incident response procedures, established an internal task force to gather information and prevent further damage, and reported the case to police and regulators within days of detection.

The investigation into the extent of the breach has concluded, with Capcom saying it will continue monitoring services and strengthening security measures to prevent similar incidents. The company has begun contacting affected customers individually through dedicated support channels.

GosuGamers reports Capcom has not revealed how attackers initially gained access to the system or who was responsible, leaving the root cause publicly unexplained even as remediation wraps up.

For Capcom ID users, the practical priorities are clear: treat any unsolicited Capcom-branded email, text, or call as suspect, verify communications through official channels, and consider unique passwords for accounts tied to a breached email address.

Capcom's fast disclosure and password resets were competent responses, but the millions of exposed emails guarantee phishing follow-up for months.