Capcom found the intrusion on October 19 and scoped it four days later. Names, addresses, phone numbers, dates of birth and purchase histories were accessed; credit card data was not. The 196 hijacked passwords and 19 store-back-end visits are the parts worth reading twice, and the scale is roughly 713 times the company's 2020 ransomware incident.
一、Timeline: found on October 19, scoped by October 23
What Capcom said first
Capcom's statement describes an unauthorised third party accessing customer information on October 19. That is a discovery date, not necessarily an intrusion date, and the company has not published the latter .
The first statement also said Capcom had "not confirmed any compromise of Capcom ID account login passwords originally set by customers," while acknowledging that passwords on 196 accounts had been changed without authorisation and had since been reset.
What the October 23 update added
The update narrowed the blast radius: of those 196 accounts, the third party opened e-Capcom account pages on 19. Capcom says emergency measures are complete, the attack method has been identified and addressed, Capcom ID services including games remain online, and affected customers are being contacted through dedicated support channels.
二、11.7 million is 713 times the 2020 incident
This is Capcom's second major breach in six years. In November 2020 a ransomware attack compromised data on 16,415 people, with the company putting the maximum potentially affected figure at 390,000.
Divide 11.7 million by 16,415 and you get roughly 713. The same perimeter was breached twice in five and a half years, and the second time was more than seven hundred times larger. That is not bad luck.
三、The 196 changed passwords matter more than the 11.7 million
Reading data and taking over accounts are different crimes
11.7 million tells you how much data was reachable. 196 tells you someone went hands-on: they changed passwords, which means they took accounts away from their owners.
196 out of 11.7 million is about 0.0017%. The number is tiny, but the nature is different. Bulk reads look like a database grab. Unauthorised password changes look like account selection — a person or a script picking targets worth keeping.
Nineteen accounts reached the store back end
Nineteen of those accounts had e-Capcom pages opened. e-Capcom is Capcom's Japanese online store, and those pages hold order history and shipping addresses.
For an attacker, the account's value is not the games. It is what this person bought, where it shipped, and what number to call. Put those three together and you have a profile built for fraud.
四、Exactly which fields were exposed
Per Capcom: name, name in Japanese phonetic characters, telephone number, postal code, address, gender, date of birth, purchase history, e-Capcom customer inquiry history, and saved address book entries.
Credit card information was not affected. That is the one genuinely reassuring line in the disclosure.
Line the fields up, though, and the pattern is obvious: name plus date of birth plus address plus phone plus purchase history is enough to impersonate support staff convincingly. "There is a problem with your order" stops sounding suspicious once the caller reads back a real order number.
五、The structural problem: one Capcom ID, every game
Capcom ID manages online features, web services and multiplayer across the portfolio, including Street Fighter 6, Monster Hunter and Resident Evil.
That is convenient: one login, every game. It also concentrates risk, because when one entry point opens, a player's identity across Capcom's entire catalogue is exposed at once.
Federated account systems are standard practice in this industry. They also turn a single-point failure into a company-wide one. The more unified the account layer, the larger the radius of every incident.
六、What players should do now
- Change the password — and not only on Capcom ID. Every account sharing that password needs a new one.
- Turn on two-factor authentication wherever it exists, especially on accounts with payment methods attached.
- Check e-Capcom. Confirm the shipping address and phone number, and look for orders you did not place.
- Be suspicious of "official support" calls. Capcom is now contacting affected customers in batches, which is exactly the window impersonators use.
It is tedious. It is also faster than waiting: the notification queue is long, and your exposure is not queued.
七、My take: the gap is disclosure, not firewalls
The number that bothers me is not 11.7 million. It is the phrasing: "services remain available" and "not confirmed" that passwords leaked.
Both statements are accurate, and both move attention away from the only question a customer has, which is what to do next. After an incident like this, the useful communication is who is affected, what was taken, and what to do about it — not a reassurance that the store is still open.
Game accounts stopped being login credentials years ago. They are purchase histories, social graphs and payment endpoints bundled into one identity, and protecting them to the standard of "a game login" was always a category error.
We will follow the remediation plan and the final scope of affected accounts on GameHub. If you have a Capcom ID, tell us in the comments which year you created it — it would be useful to know whether this hit long-time players or new ones.
FAQ
Did Capcom leak passwords this time?
Capcom says it has not confirmed a compromise of customer-set login passwords, but passwords on 196 accounts were changed without authorisation and have been reset; 19 of those accounts had e-Capcom pages opened .
Is credit card data safe?
Yes. Capcom states credit card information was not affected. The exposed fields — name, address, phone, date of birth and purchase history — are still enough to support impersonation scams.
Which games are affected?
Capcom ID covers online features, web services and multiplayer for titles including Street Fighter 6, Monster Hunter and Resident Evil. The account system is shared across the portfolio.
How does this compare with the 2020 breach?
The November 2020 ransomware attack compromised data on 16,415 people, with a maximum potential figure of 390,000. This incident affects more than 11.7 million accounts, roughly 713 times larger.