Capcom: Capcom says a data breach affected more than 11 million Capcom ID accounts, credit card details unaffected

Capcom Confirms Data Breach Affecting Over 11 Million Capcom ID Accounts

Capcom has disclosed a data breach in which a third party accessed the details of 11,774,247 Capcom ID accounts, the free accounts required for online features in games like Street Fighter 6. The breach was detected this week, with attackers obtaining user email addresses and system-specific data, including account creation dates, last login timestamps, login counts, and IP addresses from the most recent session.

For 43 accounts, additional personal information such as date of birth, gender, country/region, and nickname was exposed. While no user-set passwords were compromised, the attacker unauthorizedly reset passwords for 196 accounts, which Capcom has since restored to prevent account takeovers. The company confirmed that no credit card information was affected and will notify impacted users.

Capcom warned that exposed email addresses could lead to phishing attempts, advising users to remain cautious of suspicious messages. The company is conducting a detailed investigation and plans to strengthen its security measures to prevent future incidents. Updates will be provided via its official channels as needed.

This marks Capcom’s second major breach in four years, following a 2020 ransomware attack that exposed hundreds of thousands of personal records, including customer and employee data.

Source: https://www.videogameschronicle.com/news/capcom-says-a-data-breach-affected-more-than-11-million-capcom-id-accounts-credit-card-details-unaffected/

Capcom TPRM report: https://www.rankiteo.com/company/capcom

"id": "cap1792665698",
"linkid": "capcom",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '11,774,247',
                        'industry': 'Video Game',
                        'name': 'Capcom',
                        'type': 'Company'}],
 'customer_advisories': 'Users advised to remain cautious of phishing '
                        'attempts; updates will be provided via official '
                        'channels',
 'data_breach': {'number_of_records_exposed': '11,774,247',
                 'personally_identifiable_information': 'Date of birth, '
                                                        'gender, '
                                                        'country/region, '
                                                        'nickname (for 43 '
                                                        'accounts)',
                 'sensitivity_of_data': 'Moderate to High (PII for 43 '
                                        'accounts)',
                 'type_of_data_compromised': ['Email addresses',
                                              'Account metadata (creation '
                                              'dates, last login timestamps, '
                                              'login counts, IP addresses)',
                                              'Personal information (date of '
                                              'birth, gender, country/region, '
                                              'nickname)']},
 'date_detected': 'This week',
 'description': 'Capcom has disclosed a data breach in which a third party '
                'accessed the details of 11,774,247 Capcom ID accounts, the '
                'free accounts required for online features in games like '
                'Street Fighter 6. The breach exposed user email addresses and '
                'system-specific data, including account creation dates, last '
                'login timestamps, login counts, and IP addresses. For 43 '
                'accounts, additional personal information such as date of '
                'birth, gender, country/region, and nickname was exposed. No '
                'user-set passwords were compromised, but the attacker '
                'unauthorizedly reset passwords for 196 accounts. Capcom '
                'confirmed no credit card information was affected and will '
                'notify impacted users.',
 'impact': {'brand_reputation_impact': 'Potential impact due to phishing risks '
                                       'and repeat breach',
            'data_compromised': 'Email addresses, account creation dates, last '
                                'login timestamps, login counts, IP addresses, '
                                'date of birth, gender, country/region, '
                                'nickname',
            'identity_theft_risk': 'High for 43 accounts with additional '
                                   'personal information exposed',
            'payment_information_risk': 'None (credit card information not '
                                        'affected)',
            'systems_affected': 'Capcom ID accounts system'},
 'investigation_status': 'Ongoing',
 'post_incident_analysis': {'corrective_actions': 'Strengthening security '
                                                  'measures'},
 'recommendations': 'Strengthen security measures to prevent future incidents; '
                    'advise users to remain cautious of phishing attempts',
 'references': [{'source': 'Capcom Official Statement'}],
 'response': {'communication_strategy': 'Notifying impacted users; advising '
                                        'caution against phishing attempts',
              'containment_measures': 'Passwords restored for 196 accounts to '
                                      'prevent takeovers',
              'remediation_measures': 'Strengthening security measures'},
 'threat_actor': 'Third party',
 'title': 'Capcom Data Breach Affecting Over 11 Million Capcom ID Accounts',
 'type': 'Data Breach'}