Capcom data breach compromised over 11.7 million Capcom ID accounts

Capcom has confirmed a data breach affecting more than 11.7 million Capcom ID accounts, with customer information accessed by an unauthorised third party on October 19.

Capcom ID is the publisher's single sign-on service for online features, web services and multiplayer across its portfolio, including Street Fighter 6, Monster Hunter and Resident Evil. The scale of the incident — 11.7 million accounts — covers essentially the entire population of the publisher's registered online user base.

What has Capcom confirmed so far?

The publisher disclosed the breach in a statement posted on October 22, followed by an update on October 23. Capcom said its emergency response measures are complete and that it has identified and addressed the attack method used in the incident.

"Capcom has not confirmed any compromise of Capcom ID account login passwords originally set by customers themselves," the publisher said in its initial statement. "However, Capcom has confirmed that passwords were changed without authorisation on 196 accounts. The passwords associated with these accounts have already been reset, and the company continues to investigate the scope of any impact resulting from this incident."

The October 23 update narrowed the confirmed impact. According to Capcom, the third party accessed the account pages of e-Capcom — the online store Capcom operates in Japan — belonging to 19 of the 196 accounts whose passwords were changed without authorisation.

In plain terms: more than 11.7 million accounts were exposed to the breach, but confirmed unauthorised password changes affected 196 accounts, and confirmed data exposure from store pages affected 19.

What data was exposed?

For the 19 e-Capcom accounts accessed, the publisher listed the affected information:

• Name, and name written in Japanese phonetic characters
• Telephone number
• Postal code and address
• Gender and date of birth
• Purchase history
• e-Capcom customer inquiry history
• Saved address book information

Credit card information was not affected, Capcom confirmed.

The publisher added that services using Capcom ID, including games, remain available. Capcom has begun contacting affected customers and has established dedicated customer-support channels for inquiries related to the incident.

"The investigation into the scope of the impact from this incident has been completed," Capcom said. "Capcom will nevertheless continue monitoring Capcom ID and related services. The Company takes this incident extremely seriously and will steadily implement measures to prevent recurrence while working to further strengthen its information-security framework."

How does this compare with Capcom's 2020 ransomware attack?

This is not Capcom's first major security incident. In November 2020, a ransomware attack compromised the data of 16,415 people, with the publisher estimating at the time that the maximum number potentially affected could reach 390,000. That attack disrupted internal systems and forced delays to some of the company's operations.

The 2024 breach differs in profile: rather than ransomware encrypting internal corporate data, the incident centred on the Capcom ID authentication system itself, the gateway to the publisher's live-service and multiplayer infrastructure.

For developers and publishers operating account-based ecosystems, the incident underlines the operational stakes of identity services. A compromise of a single sign-on layer propagates risk across every title and storefront that depends on it — in Capcom's case, its fighting-game netcode accounts, Monster Hunter's online hubs and the e-Capcom commerce platform simultaneously.

Capcom says its investigation is complete, but the company has committed to continued monitoring of Capcom ID and related services, and affected customers should expect direct contact from the publisher in the coming days.