Capcom Confirms Data Breach Affecting 11.7 Million CAPCOM ID Accounts
Capcom disclosed on October 22 that its CAPCOM ID membership service used for online titles like Street Fighter 6 was compromised by unauthorized third-party access. The breach exposed 11,774,247 accounts worldwide, primarily leaking email addresses, account creation timestamps, last login details, login counts, and the IP addresses used during the most recent logins.
A smaller subset of users was more severely impacted: 43 accounts had additional data compromised, including dates of birth, gender, country/region, and nicknames, while 196 accounts experienced unauthorized password changes. Capcom confirmed that no user-set passwords or credit card information were leaked, and passwords for the affected accounts have since been reset.
The company first detected signs of the breach on October 19 and formed an internal task force to contain the incident. After confirming the data leak and unauthorized password changes, Capcom reported the breach to law enforcement on October 21. Emergency response measures have been completed, and all CAPCOM ID-linked services, including game access, remain operational.
Capcom warned that leaked data could be exploited for phishing or fraud, urging users to remain cautious of suspicious communications. The incident follows recent reports of two long-running Japanese games shutting down due to unpatched PHP vulnerabilities, highlighting ongoing risks tied to outdated infrastructure.
Capcom TPRM report: https://www.rankiteo.com/company/capcom
"id": "cap1792679839",
"linkid": "capcom",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '11,774,247 accounts worldwide',
'industry': 'Video Game',
'location': 'Japan',
'name': 'Capcom',
'type': 'Company'}],
'attack_vector': 'Unauthorized third-party access',
'customer_advisories': 'Users urged to remain cautious of suspicious '
'communications; passwords reset for affected '
'accounts.',
'data_breach': {'number_of_records_exposed': '11,774,247',
'personally_identifiable_information': 'Yes (dates of birth, '
'gender, '
'country/region, '
'nicknames for 43 '
'accounts)',
'sensitivity_of_data': 'Moderate to High (PII exposed for a '
'subset of users)',
'type_of_data_compromised': ['Email addresses',
'Account creation timestamps',
'Last login details',
'Login counts',
'IP addresses',
'Dates of birth',
'Gender',
'Country/region',
'Nicknames']},
'date_detected': '2023-10-19',
'date_publicly_disclosed': '2023-10-22',
'description': 'Capcom disclosed that its CAPCOM ID membership service used '
'for online titles like Street Fighter 6 was compromised by '
'unauthorized third-party access. The breach exposed '
'11,774,247 accounts worldwide, primarily leaking email '
'addresses, account creation timestamps, last login details, '
'login counts, and IP addresses. A smaller subset of users had '
'additional data compromised, including dates of birth, '
'gender, country/region, and nicknames, while some accounts '
'experienced unauthorized password changes. No user-set '
'passwords or credit card information were leaked.',
'impact': {'brand_reputation_impact': 'Potential phishing/fraud risks; brand '
'reputation at risk',
'data_compromised': 'Email addresses, account creation timestamps, '
'last login details, login counts, IP '
'addresses, dates of birth, gender, '
'country/region, nicknames',
'identity_theft_risk': 'High (due to PII exposure)',
'operational_impact': 'CAPCOM ID-linked services remained '
'operational',
'payment_information_risk': 'None (credit card information not '
'leaked)',
'systems_affected': 'CAPCOM ID membership service'},
'investigation_status': 'Contained; investigation ongoing',
'lessons_learned': 'Ongoing risks tied to outdated infrastructure (e.g., '
'unpatched PHP vulnerabilities); need for stronger '
'security measures to prevent unauthorized access.',
'post_incident_analysis': {'corrective_actions': 'Password resets; emergency '
'response measures; law '
'enforcement notification',
'root_causes': 'Unauthorized third-party access; '
'potential exploitation of '
'unpatched PHP vulnerabilities'},
'recommendations': 'Users should remain cautious of phishing/fraud attempts; '
'Capcom should prioritize patching vulnerabilities and '
'enhancing monitoring.',
'references': [{'date_accessed': '2023-10-22',
'source': 'Capcom Public Disclosure'}],
'response': {'communication_strategy': 'Public disclosure on 2023-10-22; '
'warnings about phishing/fraud risks',
'containment_measures': 'Emergency response measures completed; '
'passwords reset for affected accounts',
'incident_response_plan_activated': 'Yes (internal task force '
'formed)',
'law_enforcement_notified': 'Yes (reported on 2023-10-21)',
'remediation_measures': 'Passwords reset; no further details '
'provided'},
'stakeholder_advisories': 'Warnings about phishing/fraud risks; assurance '
'that services remain operational.',
'title': 'Capcom Data Breach Affecting 11.7 Million CAPCOM ID Accounts',
'type': 'Data Breach',
'vulnerability_exploited': 'Unpatched PHP vulnerabilities (implied)'}