Threat intel
Capcom ID breach: 11.77 million email records exposed
Capcom says an intruder reached 11,774,247 CAPCOM ID records and changed 196 passwords. What leaked, how it feeds phishing, and what platforms should check.
Capcom said on October 22 that an unauthorised third party accessed customer information in CAPCOM ID, the shared membership account it uses for its web services and which players need to play some of its games online. The company counts 11,774,247 affected records worldwide. Each holds an email address plus account metadata: when the account was created, when it last logged in, how many times it has logged in, and the IP address used for that last login. For 43 of those records the intruder also reached date of birth, gender, country or region and nickname.
The intruder also changed the passwords on 196 accounts. Capcom has reset those, says it has not confirmed that any password a customer set was exposed, and says no credit card data was involved. CAPCOM ID and the games that rely on it stay online. If you have a CAPCOM ID, expect phishing that uses your real address. If you run a gaming account or membership platform, read the second half for what to check.
What Capcom has confirmed
Capcom's notice, published in Japanese and English on its investor relations site, gives a day-by-day account:
- October 19: Capcom detected suspicious activity, blocked the access, confirmed it was unauthorised and started working out the attack method.
- October 20: it set up an internal incident response headquarters, confirmed which data was affected and that passwords had been changed, and reported to its external Information Technology Security Oversight Committee.
- October 21: it reported the incident to the Osaka Prefectural Police and to Japan's Personal Information Protection Commission (PPC), the national privacy regulator.
- October 22: public notice.
Capcom says emergency measures are complete and that it has identified and dealt with the attack method. It has not said what that method was, when the intruder first got in, or who it was. BleepingComputer notes that the start date of the access is unclear. Capcom is notifying affected customers in stages and has set up region-specific support channels through its customer support site.
Two cautions on the numbers. 11,774,247 is a count of records, not of confirmed people, since one person can hold several accounts. And Capcom's figures are dated "as of October 22"; it says the investigation continues and it will post updates if new facts emerge.
Why email plus login metadata is still useful to an attacker
Bare email lists circulate cheaply. The fields attached to each address here are what let an attacker choose targets and write convincing messages.
The last-login IP address points to a rough location and an internet provider, and links the email to a home or office network. The login count and last-login date separate active players from forgotten sign-ups, so an attacker can send lures only to people who will recognise a Capcom message. The creation date lets a phisher write something like "your account, registered in 2019" and get it right.
Expect three follow-ups:
- Phishing that impersonates Capcom or its partners. Capcom warns of this directly, and asks customers not to open URLs or attachments in suspicious messages. Likely themes are a password reset "because of the incident", a compensation offer, an in-game item, or a request to "verify" the account.
- Credential stuffing, where attackers try passwords leaked from other sites against a known email address. Capcom's passwords were not confirmed as exposed, but a confirmed list of active gaming emails is a good target list for logins at other game stores, launchers and shops where the same password was reused.
- Targeted account takeover. The 196 password changes show the intruder tried to take over specific accounts, which BleepingComputer describes as an apparent attempt to lock the owners out.
Capcom says registered email addresses can still be used, so there is no need to change the address on your account.
What CAPCOM ID users should do
- Treat any email about this breach that carries a link or attachment as suspect. Reach CAPCOM ID by typing the address of Capcom's site yourself.
- If your CAPCOM ID password is used anywhere else, change it on those other services first, since that is where credential stuffing will land.
- Turn on two-factor authentication on your platform and store accounts (console network, PC launcher, email). Your email account matters most, because it is where every reset link goes.
- If you are among the 196 whose password was reset, Capcom will contact you. Review any linked services and recent purchases once you are back in.
For IT teams: staff who registered with a work address will be in this set. Add Capcom-themed lures (reset notices, compensation, free items) to awareness notes this month and check mail gateway reports for messages that use them.
What gaming and membership platforms should check
Capcom has not disclosed the entry point, so there is nothing specific to patch. What the case does show is an intruder who could both read millions of account records and change passwords on some of them. Any account platform can test its own controls against that pair.
Password changes. Check every path that can set a password: the user's own settings page, the reset flow, support and admin tools, and any internal API. Each should require the current password or a fresh reset token sent to the registered email, and should send a notice to that address with a way to undo the change. Alert when password changes per hour rise well above normal, or when one admin or service identity changes more than a handful.
Credential stuffing defences. Once a list of your users' emails is public, expect more login attempts against those exact accounts. Rate limit failed logins per account as well as per IP, because stuffing traffic is spread over many proxies. Check new and changed passwords against a breached-password list, as NIST SP 800-63B recommends; the Have I Been Pwned Pwned Passwords API supports this through a k-anonymity range query, so the full password hash never leaves your server. Offer two-factor authentication or passkeys, and require it for accounts that hold paid content.
Bulk-read detection. An export of nearly 12 million rows leaves traces. Alert when any account, token or service identity reads far more member rows than its usual daily volume, and on full-table queries against the member store. Include support, analytics and marketing tools, which often have wide read access and little monitoring.
Metadata you store. Ask whether the member profile table needs the last-login IP at all, or whether it can live only in authentication logs with a fixed retention period. Dormant accounts that have not logged in for years can be closed on a schedule, which cuts the size of any future leak.
Your own sending domain. A breach of your users' emails is followed by phishing in your name. Publish DMARC (Domain-based Message Authentication, Reporting and Conformance) at p=reject on your main and marketing domains so lookalike mail sent from your exact domain fails, and register obvious lookalike domains before phishers do.
Our web penetration testing covers account flows such as password change, reset and login rate limits, and our security operations team builds the alerts for bulk reads and password-change spikes described here. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Capcom notice (English), Capcom notice (Japanese), BleepingComputer, CyberInsider, Shacknews, Gaming.net.