Capcom ID Breach: What Players Should Check Now
Capcom reports affected email and login records worldwide, with unauthorised password changes on a smaller group of accounts. Players should verify notices through official channels—not links in unexpected messages.
The short version
What you need to know
- Capcom lists 11,774,247 affected email records worldwide, alongside account and last-login information; this is a record count, not a verified count of unique people.
- Additional profile information was affected for 43 records. Passwords were changed without authorisation on 196 accounts and have been reset by Capcom.
- Capcom has not confirmed compromise of customers' original passwords. That is not the same as proving they were never accessed.
What happened
In its 22 October notice, Capcom says unauthorised access affected CAPCOM ID, the shared account used for its web services and some online games. It detected and confirmed the access on 19 October, confirmed affected customer information on 20 October and reported the incident to police and Japan's privacy regulator on 21 October. The notice does not establish when the intrusion first began.
The company lists 11,774,247 email records worldwide, with account-creation time, last-login time, login count and the client IP address used at the last login. Within that total, 43 records also involved date of birth, gender, country or region and nickname. Do not read those additional fields as applying to every affected record.
Capcom also identified unauthorised password changes on 196 accounts within the total and says it has reset those passwords. It has not confirmed compromise of passwords originally set by customers. Credit-card information was not included among the affected information, according to the company.
Why players should care even if games still work
Capcom says it has completed emergency measures, identified and addressed the attack method, and kept services available. Continued access to a game is not evidence that your account information was unaffected. The company says it will contact affected customers and continues to investigate the scope.
The immediate reader concern is an unexpected message that uses a real service name to make an account-recovery demand look credible. Capcom warns that affected information could be misused for impersonation emails or other communications. Its notice describes a possibility, not a confirmed phishing campaign.
What you can do now
Open Capcom's official incident notice yourself and use the regional support routes listed there if you need help. For UK readers, the notice includes a Europe, Middle East and Africa support section. Avoid links or attachments in unexpected messages claiming that your account will be deleted or that payment is needed to secure it.
Check your account through the service's established website or a saved bookmark. If you cannot sign in or see unexpected changes, use the official recovery and support process rather than a recovery link sent by a stranger. Never give someone your password or one-time login code in a support conversation.
Use a unique password for the account and for your email inbox. If you have reused one, replacing it through the genuine account settings is sensible hygiene, not a claim that Capcom has confirmed a password leak. Keep any verified notification so you can follow instructions specific to your account; the notice does not say every user must perform an emergency reset.
Where a VPN does not help
A VPN protects traffic between your device and the VPN server. It cannot undo access inside Capcom's systems, restore an account changed by an attacker or establish whether a support message is genuine. Although the affected records include last-login IP addresses, changing your current IP address does not remove an address already stored in a breached record. Verified communications and account security are the useful steps here.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.